SQL Injection in Link Whisper Free 0.9.7 Allows Blind Attacks on Affected Systems

A critical security vulnerability has been identified in the Link Whisper Free plugin, affecting all versions up to and including 0.9.7. The issue is classified as a blind SQL injection flaw that allows attackers to manipulate database queries without visible feedback on the application front-end.

What happened

The National Vulnerability Database records CVE-2026-109688 as a critical severity issue within the Link Whisper Free software developed by Link Whisper INC. The vulnerability stems from improper neutralisation of special elements used in SQL commands, specifically enabling blind SQL injection techniques. This weakness is present in all versions of the plugin released prior to and including version 0.9.7. The Common Weakness Enumeration classifies this as CWE-89, which relates to SQL injection flaws. The National Vulnerability Database assigns a CVSS score of 9.3 to this specific instance.

Why it matters

Organisations running the Link Whisper Free plugin on their web infrastructure face exposure to the vulnerabilities described in the NVD record. Blind SQL injection allows attackers to manipulate database queries, as stated in the vulnerability description. The critical rating reflects the severity assigned by the National Vulnerability Database to this specific instance of improper neutralisation. The flaw is categorised under CWE-89, indicating a standard classification for SQL injection weaknesses.

What happens next

Security teams should immediately audit their environments to identify any installations of Link Whisper Free. Administrators must verify the current version of the plugin against the affected range ending at 0.9.7. If an installation falls within this range, it is considered vulnerable according to the NVD record. Teams should prepare to isolate affected systems if necessary while assessing the scope of potential exposure. Monitoring for unusual database activity is recommended as a precautionary measure.

Patch priority

Teams usually prioritise systems with direct internet exposure when addressing critical injection flaws. Check whether the affected plugin is installed on public-facing web servers or internal portals accessible to untrusted networks. Verify the current version against the known vulnerable range before proceeding. Back up configuration files and databases before making any changes to the software environment. Test updates in a staging environment if possible to ensure compatibility with existing site functionality. Reduce exposure by restricting access to the affected application until a verified fix is deployed.

What to do and how to stay safe: Link Whisper Free

• Audit all web servers to identify installations of Link Whisper Free and check their version numbers against the affected range.
• Monitor database logs for unusual query patterns or unexpected access attempts that may indicate exploitation of the SQL injection flaw.
• Restrict access to the affected application from untrusted networks while evaluating the risk and preparing for remediation.
• Prepare to apply updates from the vendor once a patched version of the plugin is confirmed to be available and tested.

Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality

General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Link Whisper Free are affected by CVE-2026-109688?

All versions of Link Whisper Free from the initial release through version 0.9.7 are affected by this vulnerability.

What is the severity rating for this SQL injection flaw?

The National Vulnerability Database rates CVE-2026-109688 as Critical with a CVSS score of 9.3.

Is there a confirmed fix for this vulnerability yet?

No fix has been confirmed yet, as the source material does not mention an available patch or update.