The vulnerability is an improper neutralization of special elements used in an SQL command, allowing attackers to perform a blind SQL injection against the Link Whisper Free plugin. An attacker could inject malicious SQL, potentially gaining read or write access to the database, exfiltrating data, or executing destructive commands that compromise the integrity and confidentiality of the WordPress site. The high CVSS score reflects the remote nature and severe impact of this flaw.

Link Whisper INC’s Link Whisper Free plugin, version 0.9.7 or earlier, running on WordPress installations. The issue applies to all installations of the plugin that have not been upgraded beyond 0.9.7.

The CVSS score of 9.3 indicates a high severity, and although the EPSS score is low (<1%), the potential for immediate exploitation remains given the remote nature of the attack. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending crafted input to the plugin’s back‑end endpoints that construct SQL queries without adequate filtering. Vendor mitigation is available via updating to the latest version (0.9.8 or newer), which addresses the vulnerability, and this remains the primary defense.