CVE-2026-5062
Received Received - Intake

SQL Injection in PrettyLinks WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' (search) parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `search_links_table()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-5062
EUVD
EUVD-2026-53034

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pretty_links pretty_links to 3.6.20 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL Injection vulnerability in the PrettyLinks WordPress plugin. It allows authenticated attackers with Administrator access or higher to inject malicious SQL queries via the 's' search parameter on the Pretty Links listing page. The flaw exists due to insufficient input escaping and lack of proper SQL query preparation in the search_links_table() function.

Detection Guidance

This vulnerability requires authenticated access with Administrator-level privileges or higher. Detection involves checking for unusual SQL query patterns in logs or monitoring database activity for unexpected queries. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to extract sensitive data from the WordPress database, such as user credentials, personal information, or other confidential data. Since it requires Administrator-level access, the primary risk is for sites where credentials have been compromised or where insider threats exist.

Compliance Impact

This vulnerability could lead to unauthorized access and exfiltration of personal data, violating GDPR's data protection principles and potentially HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Immediately update the PrettyLinks plugin to the latest version beyond 3.6.20. If updating is not possible, disable the plugin until a patch is applied. Review database access logs for suspicious queries and restrict Administrator-level access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart