PatchSiren cyber security CVE debrief
CVE-2026-5062 supercleanse CVE debrief
The PrettyLinks plugin for WordPress has a SQL Injection vulnerability via the 's' parameter on the Pretty Links listing page in versions up to 3.6.20. Authenticated attackers with Administrator-level access can append SQL queries to extract sensitive database information. This vulnerability has a CVSS score of 4.9 and is considered Medium severity. The vulnerability is caused by insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `search_links_table()` function. WordPress administrators and users with Administrator-level access who have the PrettyLinks plugin installed should review and verify affected product deployments, plan vendor-supported updates or mitigations, and implement compensating controls for exposed systems while remediation is scheduled and verified.
- Vendor
- supercleanse
- Product
- PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
- CVSS
- MEDIUM 4.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-05
- Original CVE updated
- 2026-08-05
- Advisory published
- 2026-08-05
- Advisory updated
- 2026-08-05
Who should care
WordPress administrators and users with Administrator-level access who have the PrettyLinks plugin installed should review and verify affected product deployments, plan vendor-supported updates or mitigations, and implement compensating controls for exposed systems while remediation is scheduled and verified.
Technical summary
The PrettyLinks plugin for WordPress is vulnerable to SQL Injection via the 's' parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `search_links_table()` function. Authenticated attackers with Administrator-level access and above can append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Defensive priority
Medium priority due to SQL Injection vulnerability with CVSS score of 4.9
Recommended defensive actions
- Inventory and verify PrettyLinks plugin version
- Restrict access to Pretty Links listing page
- Monitor for suspicious database queries
- Apply vendor patch or update to version above 3.6.20
- Implement web application firewall rules
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The PrettyLinks plugin for WordPress has a SQL Injection vulnerability via the 's' parameter on the Pretty Links listing page in versions up to 3.6.20. Evidence from Wordfence and NVD indicates SQL Injection vulnerability in PrettyLinks plugin. Limited details on affected scope and vendor remediation. The CVE record was published on 2026-08-05T06:16:38.097Z and has not been modified since then. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T06:16:38.097Z and has not been modified since then.