The ShortLinks Pro plugin, developed by Ruben Garcia, contains an improper handling of user input that allows an attacker to inject arbitrary SQL commands into database queries. This flaw, identified as CWE‑89, can lead to unauthorized disclosure, modification, or deletion of data stored in the WordPress site’s database, compromising confidentiality, integrity, and potentially availability. The vulnerability affects all installations running ShortLinks Pro version 1.0.7 or earlier.

WordPress sites that have the ShortLinks Pro plugin version 1.0.7 or earlier installed. Any installation using a vulnerable version is within scope.

The risk rating is CVSS 7.6, indicating a high severity. The EPSS score of less than 1% suggests a low probability of exploitation at the time of assessment, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit this vulnerability remotely by supplying malicious payloads through the plugin’s input fields or URL parameters, requiring network access to the WordPress site and the ability to submit requests. Successful exploitation could permit read or write access to the database depending on the database user's privileges.