Executive brief
Link Whisper Free is a popular WordPress plugin that helps manage internal and external site links. An authenticated user with Editor role or higher can inject SQL commands through an unsanitized parameter to extract sensitive database information such as usernames, passwords, or email addresses without direct authorization.
Technical details
Link Whisper Free before version 0.9.7 fails to properly sanitize and escape the 'domain' parameter in the get_domain_report_data AJAX action before incorporating it into a SQL query. The vulnerability is a classic SQL injection (CWE-89) requiring authentication as a user with Editor role or above. An attacker can craft malicious payloads using SQL logical operators to create a boolean oracle, extracting database information character by character. The vulnerability affects both 'view-links' and 'view-posts' view types across the affected version range, though view-posts was partially hardened in 0.9.6. The fix in version 0.9.7 properly sanitizes the domain parameter.
Affected products
- Link Whisper Link Whisper Free before 0.9.7
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Version 0.9.7 released
- 2026-08-21: other: CVE-2026-14601 published