CVE-2026-109686

{
  "etk_id": "ETK-2026-1681",
  "cve_id": "CVE-2026-109686",
  "display_id": "CVE-2026-109686",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-102053",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Object injection in Link Whisper Free",
  "summary": "Link Whisper Free through version 0.9.7 is affected by unsafe deserialization that can permit object injection. An unauthenticated remote attacker may be able to compromise the affected WordPress site; the record indicates no user interaction is required.",
  "mitigation": "Disable and remove the affected plugin where feasible until the maintainer provides an updated release. Otherwise, restrict public access to the WordPress site and closely limit exposure to untrusted requests.",
  "vendor": "Link Whisper INC",
  "product": "Link Whisper Free",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.9.7"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "link-whisper",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0031,
  "epss_percentile": 0.2283,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 29.3813826,
  "t0_at": "2026-10-15T13:00:24.207000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-15T14:05:29.345541+00:00",
      "days": 0.04519836274305555,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T13:00:24.207000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-15T13:00:24.207000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T13:00:24.207000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109686"
    }
  }
}