Executive brief
The PrettyLinks WordPress plugin, used for managing affiliate links and tracking marketing performance, contains a SQL injection vulnerability in its search functionality. An attacker with administrator access can inject malicious SQL commands to extract sensitive data from the website's database, potentially exposing customer information, transaction records, or other confidential business data.
Technical details
The vulnerability is a SQL injection flaw in the `search_links_table()` function affecting the 's' (search) parameter on the Pretty Links listing page. The vulnerability stems from insufficient escaping of user-supplied input and inadequate preparation of SQL queries. The attack requires authenticated access with Administrator-level privileges and network access to the WordPress admin panel. A successful exploit allows an attacker to append arbitrary SQL queries to extract sensitive information from the database. The vulnerability affects all versions up to and including 3.6.20; patched versions should be available.
Affected products
- Automattic PrettyLinks up to and including 3.6.20
Timeline
- 2026-08-05: disclosed