CVE-2026-109687: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Link Whisper INC Link Whisper Free

This vulnerability involves improper neutralization of special elements used in SQL commands (SQL Injection) in the Link Whisper Free plugin by Link Whisper INC. It specifically allows blind SQL injection attacks, which can be exploited by an attacker with high privileges and no user interaction required. The vulnerability affects all versions from initial release up to but not including 0.9.8. The CVSS 3.1 score is 7.6, indicating a high severity with network attack vector, low attack complexity, and a scope change. Confidentiality impact is high, integrity impact is none, and availability impact is low.

An attacker with high privileges can exploit this vulnerability remotely without user interaction to perform blind SQL injection, potentially leading to full disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity is not impacted. This could compromise the security of the affected system's database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and avoid exposing the vulnerable plugin to untrusted users with high privileges until a fix is available.