PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5062 supercleanse CVE debrief

The PrettyLinks plugin for WordPress has a SQL Injection vulnerability via the 's' parameter on the Pretty Links listing page in versions up to 3.6.20. Authenticated attackers with Administrator-level access can append SQL queries to extract sensitive database information. This vulnerability has a CVSS score of 4.9 and is considered Medium severity. The vulnerability is caused by insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `search_links_table()` function. WordPress administrators and users with Administrator-level access who have the PrettyLinks plugin installed should review and verify affected product deployments, plan vendor-supported updates or mitigations, and implement compensating controls for exposed systems while remediation is scheduled and verified.

Vendor
supercleanse
Product
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
CVSS
MEDIUM 4.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-05
Original CVE updated
2026-08-05
Advisory published
2026-08-05
Advisory updated
2026-08-05

Who should care

WordPress administrators and users with Administrator-level access who have the PrettyLinks plugin installed should review and verify affected product deployments, plan vendor-supported updates or mitigations, and implement compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The PrettyLinks plugin for WordPress is vulnerable to SQL Injection via the 's' parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `search_links_table()` function. Authenticated attackers with Administrator-level access and above can append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Defensive priority

Medium priority due to SQL Injection vulnerability with CVSS score of 4.9

Recommended defensive actions

  • Inventory and verify PrettyLinks plugin version
  • Restrict access to Pretty Links listing page
  • Monitor for suspicious database queries
  • Apply vendor patch or update to version above 3.6.20
  • Implement web application firewall rules
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The PrettyLinks plugin for WordPress has a SQL Injection vulnerability via the 's' parameter on the Pretty Links listing page in versions up to 3.6.20. Evidence from Wordfence and NVD indicates SQL Injection vulnerability in PrettyLinks plugin. Limited details on affected scope and vendor remediation. The CVE record was published on 2026-08-05T06:16:38.097Z and has not been modified since then. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5062 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5062

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5062 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5062

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/pretty-link/tags/3.6.20/app/controllers/PrliLinksController.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/pretty-link/tags/3.6.20/app/controllers/PrliLinksController.php

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.