Blind SQL injection in Link Whisper INC Link Whisper Free can expose WordPress data

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

• Link Whisper INC Link Whisper Free, WordPress package link-whisper.
• Versions 0 through 0.9.7: marked affected in the structured record. The package has default_status set to unaffected, while the listed range is explicitly marked affected.
• Version 0.9.8: recorded as unaffected in the change record and identified as the patched release.
• The source description states from n/a through 0.9.7. This record does not establish another affected branch, and the status of parallel or newer branches has not been independently confirmed.

The vulnerability is classified as CWE-89, where attacker-controlled input is not properly neutralized before it is used in an SQL command. The record describes blind SQL injection in the link-whisper package of Link Whisper Free. The supplied attack characteristics indicate that the vulnerable functionality is reachable over the network without authentication or user interaction and with low complexity. The record does not identify an endpoint, request parameter, query, database engine, or code path, so the exact injection point and data retrieval behavior remain unknown. The assessment marks the scope as changed, which suggests that consequences may cross the plugin's immediate security boundary, but the concrete boundary is not documented.

• The record describes network reachability.
• Authentication and user interaction are not required, and the stated attack complexity is low.
• The record does not mark the vulnerability as exploited and does not identify a public exploit. The known_exploited field also provides no confirmation of exploitation in the wild.
• The record includes CISA enrichment marking exploitation as none and automation as yes. This is a source assessment and does not show that exploitation is impossible.
• No specific exploit, campaign, victim, breach, or IOC is named.

Blind SQL injection may allow an attacker to infer database information from query behavior, potentially exposing WordPress data or other private information accessible to the plugin. The supplied assessment indicates high confidentiality impact, low availability impact, and no integrity impact, but those are assessment characteristics rather than evidence that an incident occurred. Possible organizational consequences include data exposure, investigation requirements, and service degradation caused by abnormal database activity. The specific data reachable and the actual extent of impact depend on the query context and database permissions, which are not disclosed.

• A successful attack could expose data in the WordPress database, including account information or private content if those records are within the query scope.
• Abnormal SQL activity could increase database load or contribute to service degradation.
• Because sensitive data may be exposed, organizations should prioritize inventory checks, plugin updates, and telemetry review for affected sites.
• The record does not establish that a breach, data loss, or service outage has occurred.

1. Update Link Whisper Free to the latest available version, with 0.9.8 as the minimum version explicitly named by the record. Verify the installed version after updating rather than relying only on the WordPress update status.
2. If updating is not immediately possible, check whether the Patchstack mitigation rule can be enabled for the deployment in use. Treat this as a temporary measure while completing the update, and confirm the rule's coverage on the specific system.
3. Recheck all WordPress sites and staging environments so that no link-whisper package remains on an affected version.
4. Review logs and database telemetry for the period in which affected versions were active. If suspicious query activity is found, follow the organization's incident response process because the record provides no specific IOC.

1. Inventory every WordPress site that installs Link Whisper Free and identify the installed link-whisper package and version.
2. Prioritize installations from 0 through 0.9.7 and confirm that updated installations reach 0.9.8 as the named fixed release.
3. Review web server, WAF, and database telemetry for anomalous requests or SQL errors associated with plugin activity. This is precautionary monitoring because the record provides no specific endpoint, log event, or IOC.
4. If using a Patchstack mitigation rule, verify that the rule is enabled and applies to the affected deployments.
5. Do not treat the absence of suspicious log entries as proof of safety; confirm exposure through inventory and version checks.