The Link Whisper Free plugin up to version 0.9.7 contains an SQL injection flaw that allows an attacker to inject arbitrary SQL commands through specially crafted input fields. The vulnerability is classified as CWE‑89. Because the plugin processes link data without proper sanitization, the attacker can potentially modify or delete data in the WordPress database or read sensitive information. The flaw is described as a blind SQL injection, so direct error messages may not be returned.

This issue impacts WordPress sites that have installed the free version of the Link Whisper plugin with a version number of 0.9.7 or earlier. The plugin is widely used for internal link building, so many sites, regardless of traffic level, could be vulnerable. Any WordPress installation that has the plugin present is affected, independent of other plugins or themes.

The CVSS score of 7.6 indicates high severity, while the EPSS score is not available, meaning the exploitation probability is unknown but could be significant for targeted attacks. The vulnerability is not listed in CISA’s KEV catalog, implying no widespread exploitation has been publicly reported. The attack path involves sending maliciously crafted HTTP requests to the plugin’s endpoints, allowing the attacker to blind injection and potentially compromise the database. The CVE description does not specify authentication requirements, so whether authentication or elevated privileges are needed is unclear.