Blind SQL Injection in Link Whisper INC Link Whisper Free

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

• Link Whisper INC Link Whisper Free, package link-whisper: affected from 0 through 0.9.7, including releases no greater than 0.9.7.
• 0.9.8 is marked unaffected in the affected data.
• The default status is recorded as unaffected outside the explicitly affected range.

Link Whisper INC Link Whisper Free contains CWE-89, where special elements used in an SQL command are not properly neutralized. The CNA describes the issue as blind SQL injection, allowing SQL query results to be inferred from application behavior rather than returned directly. The record indicates network reachability and requires an Editor-level account; no user interaction is required. The affected package is link-whisper. The vulnerable parameter, endpoint, query, and exact input path are not disclosed, so those implementation details remain unknown.

The recorded attack profile is network-based, low complexity, requires high privileges, and does not require user interaction. Patchstack identifies Editor as the required privilege. The supplied record marks public exploit as false, while CISA enrichment records exploitation as none; this reflects the available evidence and does not prove that abuse is impossible. No campaign, victim, payload, or specific indicator is identified.

The flaw allows a remote attacker with the required Editor privilege to perform blind SQL injection through reachable plugin functionality. The recorded outcome is primarily a confidentiality risk, with limited potential availability impact and no described integrity impact. The record marks the scope as changed, but public details do not explain the specific security boundary crossed. The record does not establish a breach, data loss, or data modification.

Organizations using the affected plugin may face database confidentiality risk if an attacker has the required Editor-level access. The practical exposure depends on database permissions, the data accessible to the plugin, and how the vulnerable endpoint is deployed, none of which are specified in the public details. The record characterizes the confidentiality impact as high and the availability impact as low, but it does not confirm that data was accessed or that any system was compromised. If suspicious activity is found, the organization should review logs and assess the scope of data that could have been queried.

1. Update the WordPress Link Whisper Free plugin to the latest available version, at least 0.9.8.
2. Verify the deployed version on every WordPress site; updating one site does not establish that the whole environment is remediated.
3. If an immediate update is not possible, treat installations within the affected range as exposed and apply deployment-level access restrictions as a precaution. The record does not provide a specific vendor-supplied interim mitigation.
4. After updating, recheck inventory to confirm that no affected installation remains, and continue reviewing telemetry if unusual database activity was observed.

1. Inventory every WordPress site where the link-whisper package is installed or enabled, including sites managed by hosting providers or external operators.
2. Check the deployed plugin version on each site and compare it with the affected boundary in affected_summary.
3. Identify sites with Editor accounts and network-accessible WordPress administration, because these are the recorded exploitation preconditions.
4. As a precaution, review web server and database telemetry for unusual requests or queries associated with plugin functionality. The record does not provide a vulnerable endpoint, parameter, or log signature, so these reviews are not confirmed indicators of compromise.
5. Do not treat the absence of suspicious logs as proof of safety; confirm exposure through inventory and version checks.