The PrettyLinks plugin for WordPress contains a SQL injection flaw caused by insufficient escaping and lack of query preparation in the search_links_table() function. The flaw allows an authenticated attacker with Administrator or higher privileges to inject arbitrary SQL through the 's' (search) parameter on the Pretty Links listing page. This can be used to read or exfiltrate sensitive database information, compromising data confidentiality.

The vulnerability affects the supercleanse PrettyLinks plugin, including all versions up to and including 3.6.20. Users running these versions must verify their installation and upgrade to a later release or remove the plugin.

The CVSS score for this issue is 4.9, indicating a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation has not yet been confirmed. Because the flaw requires authenticated Administrators, the attack vector is local but can be triggered remotely once the attacker gains legitimate access. Potential impact is limited to data disclosure rather than code execution or broader system compromise.