CVE-2026-15090: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in jackdewey Link Library

CVE-2026-15090 is a SQL Injection vulnerability (CWE-89) in the Link Library WordPress plugin by jackdewey. The vulnerability arises from improper neutralization of special elements in the 'link_url' parameter, enabling unauthenticated attackers to append malicious SQL commands to existing queries. This is due to insufficient escaping of user input and lack of prepared statements. The vulnerability affects all plugin versions from 0 up to and including 7.9.2. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

An unauthenticated attacker can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the WordPress database. The attack does not require privileges or user interaction and can be performed remotely over the network. The confidentiality of data is at high risk, but integrity and availability are not impacted according to the CVSS vector.

No official patch or fix is currently provided as no patch links or vendor advisories are available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or removing the Link Library plugin or applying manual mitigations such as input validation and query parameterization if feasible.