Link Whisper Free: Unauthenticated PHP Object Injection & Blind SQL Injection

Threat Overview

A pair of critical security vulnerabilities disclosed in Link Whisper Free, a popular internal-linking and SEO plugin for WordPress, exposes affected websites to unauthenticated PHP object injection and blind SQL injection attacks.

Tracked under CVE-2026-109686 (CVSS 9.8) and companion database flaw CVE-2026-109688 (CVSS 9.3), both vulnerabilities are reachable over the network without credentials or user interaction. Unpatched installations running versions up to and including 0.9.7 face immediate risk of automated database harvesting and server-side payload execution.

The Breakdown: How the Exploit Works

Link Whisper scans post content and anchor text to recommend contextual internal links inside the WordPress editor. To process link telemetry across requests, the plugin parses serialized payloads and runs custom database queries.

In versions up to and including 0.9.7, an unauthenticated request path passes attacker-controlled serialized input directly into PHP deserialization without cryptographic signature verification (CVE-2026-109686). Submitting crafted serialized strings causes the PHP runtime to reconstruct attacker-selected objects in memory, activating Property-Oriented Programming (POP) gadget chains present in WordPress core or adjacent plugins.

Simultaneously, CVE-2026-109688 allows unauthenticated input to reach a backend SQL query without parameterized preparation, enabling remote attackers to infer and extract sensitive database rows without logging in.

The Operational Risk: What an Attacker Gains

• Remote Code Execution: Paired with active plugin class methods, object injection enables attackers to write arbitrary files, drop PHP webshells, or execute server commands.
• Unauthenticated Database Exfiltration: Using blind SQL injection, automated scripts extract administrator password hashes, session tokens, API keys in wp_options, and customer records.
• Arbitrary File Deletion: Deserialization gadgets frequently expose file-deletion destructors, allowing attackers to erase wp-config.php and trigger an open installation prompt for full site takeover.
• Silent SEO Poisoning: Intruders who compromise an SEO plugin routinely inject cloaked spam links and redirects into high-ranking pages.

Our Take in Plain English

“Business owners install SEO plugins to grow search traffic, never suspecting that a marketing helper tool can open a direct backdoor into their database. On a dynamic WordPress site, every plugin shares the same live PHP runtime and database privileges—meaning a single deserialization or SQL flaw in an SEO add-on puts the entire business at risk. In a modern pre-rendered edge architecture, internal linking and SEO structure are computed at build time before the site ever touches the public internet, leaving zero live database queries or PHP object parsers to exploit.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Executes link-scanning queries and PHP serialization routines directly on the live production server alongside customer data and administrator credentials.
• Modern Pre-Rendered Edge Architecture: Evaluates internal link graphs and structured schema during an isolated build step, deploying immutable static assets to global edge nodes with zero exposed database or PHP execution surface.

Immediate Action Items for WordPress Operators

1. Upgrade Link Whisper Immediately: Update link-whisper to version 0.9.8 or higher across all environments.
2. Audit Admin Users: Inspect wp_users for unauthorized administrator accounts and rotate database credentials on exposed sites.
3. Inspect High-Traffic Pages: Check recent post revisions and outbound links for unauthorized insertions.
4. Enforce Firewall Filtering: Block unauthenticated requests carrying serialized PHP object signatures (O: or C: patterns).