CVE-2026-109688: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Link Whisper INC Link Whisper Free

The vulnerability identified as CVE-2026-109688 affects Link Whisper Free versions before 0.9.8. It is caused by improper neutralization of special elements used in SQL commands, enabling Blind SQL Injection attacks. The CVSS 3.1 score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No known exploits in the wild or patch links are provided in the data.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to extract sensitive information from the database (high confidentiality impact) and cause limited denial of service (low availability impact). Integrity impact is not indicated. The vulnerability does not require user interaction or privileges, increasing the risk of remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider restricting access to the vulnerable plugin or disabling it if possible.