The vulnerability resides in the Link Whisper Free WordPress plugin, prior to version 0.9.7, where the "domain" parameter is incorporated into a SQL statement without proper sanitization or escaping. Attackers who are logged in with Editor-level or higher permissions can supply crafted input that results in arbitrary SQL execution. This flaw can lead to data exfiltration, data manipulation, or potentially full database compromise. The weakness is a classic SQL injection (CWE‑89) arising from inadequate input validation (CWE‑20).

Affected product: Link Whisper Free plugin for WordPress, any installation using a version earlier than 0.9.7. The plugin is widely used in WordPress environments to manage internal linking. The vulnerability impacts all sites that have the plugin installed and in which an authenticated Editor or higher user has permission to interact with the plugin's editor interface. No specific vendor software beyond the plugin itself is listed as affected; the WordPress core is not directly compromised by the flaw.

Although no CVSS score has been assigned and EPSS data is unavailable, the risk remains significant because the flaw permits arbitrary SQL manipulation when an adequate user role is present. The lack of a KEV listing indicates no publicly disclosed exploit has yet been reported, but the vector does not require special conditions beyond given permissions. The potential impact spans confidentiality, integrity, and availability of the underlying database, and the exploitation path is straightforward for an authenticated user with Editor rights, making the vulnerability actionable once the user has logged in.