CVE-2026-109686
9.8CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Remote, unauthenticated attackers can execute arbitrary code or tamper with site data through PHP object injection. No prior access or user interaction is required.
Root cause
The plugin deserializes untrusted user-supplied input without adequate validation.
Affected systems
Link Whisper Free through 0.9.7
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Link Whisper Free to a version higher than 0.9.7 once available. If an update is unavailable, deactivate and uninstall the plugin immediately.
$ wp plugin deactivate link-whisperAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.