CVE-2026-5062 describes an SQL Injection vulnerability in the PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links WordPress plugin by supercleanse. The issue exists in all versions up to and including 3.6.20, specifically in the handling of the 's' search parameter on the Pretty Links listing page. The vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89) due to insufficient escaping and lack of prepared statements in the search_links_table() function. Authenticated attackers with Administrator privileges can append malicious SQL queries to extract sensitive data from the database.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, allowing unauthorized reading of sensitive information from the database. The vulnerability does not affect integrity or availability but impacts confidentiality. Exploitation requires high privileges and no user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the PrettyLinks plugin. Avoid using the vulnerable versions (<=3.6.20) in production environments if possible.