Organisations at Risk: Link Whisper Free v0.9.7 Suffers Critical Blind SQL Injection Vuln

A severe security vulnerability has been identified in the Link Whisper Free plugin, exposing websites using older versions to potential database attacks. This issue allows attackers to perform blind SQL injection, a method that can compromise sensitive information stored within the site’s backend systems.

According to the National Vulnerability Database record for CVE-2026-109688, the flaw carries a CVSS score of 9.3, marking it as critical. This high severity rating indicates that the vulnerability is significant and relates to improper neutralisation of special elements in SQL commands.

What we know

The vulnerability stems from improper neutralisation of special elements used in SQL commands. This specific weakness is categorised under CWE-89, which relates to SQL injection flaws. The issue permits blind SQL injection, meaning an attacker can infer data from the database even if the results are not directly displayed on the screen.

This problem affects Link Whisper Free, a product developed by Link Whisper INC. The vulnerability is present in all versions of the plugin from its initial release up to and including version 0.9.7. Users running any of these versions are considered affected by this security risk.

Defender's checklist

• Verify if your website uses the Link Whisper Free plugin.
• Check the current version number against the affected range (up to 0.9.7).
• Review database logs for any unusual query patterns or unexpected errors.
• Ensure your web application firewall rules are updated to detect SQL injection attempts.

The background in plain language

SQL injection occurs when an attacker tricks a website into running malicious database commands. Blind SQL injection is a variant where the attacker cannot see the direct output but can deduce information based on how the system responds. Teams usually monitor for these attacks by looking for slow response times or specific error codes. Understanding this helps explain why even hidden data can be at risk without visible signs of a breach on the front end.

Background: SQL injection

SQL injection occurs when untrusted data is inserted into a database query without proper sanitisation. The attacker manipulates input fields to alter the query structure, tricking the database into executing unintended commands. This process bypasses application logic, granting direct access to underlying data stores.

Read the full guide: How SQL Injection Works: The Step-by-Step Attack Lifecycle

What to do and how to stay safe: Link Whisper Free

• Update the Link Whisper Free plugin to the latest available version immediately.
• If an update is not possible, restrict access to the affected pages using IP whitelisting.
• Monitor server logs for signs of SQL injection attempts, such as unusual query strings.
• Consider temporarily disabling the plugin if you cannot verify your version is safe.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-109688?

It is a critical SQL injection vulnerability in Link Whisper Free versions up to 0.9.7.

Which versions of Link Whisper Free are affected?

All versions from the initial release through version 0.9.7 are affected.

How severe is this vulnerability?

It is rated critical with a CVSS score of 9.3.