Column 1
Skip to content

Link Whisper Free 0.9.8 Security Update Guide

October 13, 2026

WordPress sites using Link Whisper Free through version 0.9.7 need a security update. Patchstack’s record for CVE-2026-109687 describes a high-severity SQL-injection issue and identifies version 0.9.8 as repaired. The official WordPress directory reports version 0.9.8 and lists that release when checked for this guide.

The published assessment requires high privileges. Do not describe this as an unauthenticated vulnerability affecting every WordPress visitor. The advisory establishes a version risk and repair target; it does not establish active exploitation or prove that an individual site was compromised.

Check the installed edition and version

Match the installed plugin to Link Whisper Free in the official WordPress directory. Do not assume that another edition or similarly named linking tool has the same affected range. The CNA record lists versions from 0 through 0.9.7 inclusive as affected and changes the status to unaffected at 0.9.8.

Version 0.9.8 is the repair floor verified for this advisory, not a permanent latest-version recommendation. Use a maintained release that includes the fix, and confirm the current WordPress and PHP requirements for the actual site.

Plan the maintenance around normal publishing

  1. Record the installed version, environment and maintenance owner. Review which trusted accounts can use the site’s privileged linking and publishing features.
  2. Check the plugin’s current compatibility information against a supported WordPress and PHP installation. Do not treat an old directory minimum as approval to keep an end-of-life platform.
  3. Confirm the site’s established maintenance and recovery arrangements. There is no need to alter customer backup schedules or create a routine full-account archive for this publishing checklist.
  4. Update through the approved WordPress or hosting workflow and record the version shown after installation.

Verify authorized linking workflows

Check the normal internal-link review and publishing tasks used by the site. Confirm that expected pages and links still display correctly and that authorized administrators retain normal access. Review unexpected WordPress or database errors through ordinary monitoring rather than running untrusted security-testing instructions on production.

These checks establish expected operation after maintenance. They do not certify the absence of an earlier incident. Keep any suspicious-activity review separate, protect evidence and avoid exposing visitor, subscriber or customer data.

Do not substitute an unverified edge-control claim

A WAF or CDN assessment may identify additional controls, but it does not prove that the relevant requests traverse that control or that a rule has been deployed safely. The plugin repair remains the verified action in this guide; no deployed protection or local compromise is asserted.

For maintenance ownership and escalation, start with the WordPress support hub. Related information is available in the WordPress hub, security hub and hosting hub.

Sources