PrettyLinks <= 3.6.20 Authenticated SQL Injection in 's' Parameter (CVE-2026-5062)

Vulnerability Overview Vulnerability Name: PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter CVE ID: CVE-2026-5062 CVSS Score: 4.9 (Medium) Release Date: August 4, 2026 Last Updated: August 5, 2026 Researcher: Michael Iden (Mickael) - Hack The Box Impact Scope Software Type: Plugin Software Name: PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links Affected Versions: <= 3.6.20 Fixed Version: 3.6.21 Remediation Remediation Measure: Update to version 3.6.21 or a newer patched version. Vulnerability Description The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin contains a SQL injection vulnerability in the 's' (search) parameter of the function on the Pretty Links list page. This vulnerability arises from insufficient sanitization of user-supplied parameters, allowing additional SQL queries to be injected into existing SQL queries. This enables attackers with administrator-level access to append additional SQL queries to existing ones, thereby extracting sensitive information from the database. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Recently Discovered PrettyLinks Vulnerabilities: - Shortlinks by Pretty Links <= 3.6.15 - Missing Authorization (CVE-2025-48247) - Shortlinks by Pretty Links <= 3.6.2 - Reflected Cross-Site Scripting via post_status (CVE-2024-29770) - Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin <= 3.6.3 - Cross-Site Request Forgery to Plugin Settings Update (CVE-2024-22326) - Shortlinks by Pretty Links <= 3.4.0 - Cross-Site Request Forgery via route (CVE-2022-47149) - Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link (CVE-2019-25147) - Pretty Links – Link Management, Branding, Tracking & Sharing Plugin <= 1.6.7 - SQL Injection (CVE-2015-9457) - Pretty Links Lite <= 1.6.3 - Stored Cross-Site Scripting (CVE-2013-1636) - Pretty Links – Link Management, Branding, Tracking & Sharing Plugin <= 1.5.6 - Reflected Cross-Site Scripting (CVE-2011-4595) Copyright Information Copyright: 2012-2026 Defiant Inc. License: Defiant grants a permanent, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly perform, publicly display, distribute, and disseminate software vulnerability information. MITRE License: CVEs use the permanent, worldwide, non-exclusive, royalty-free, irrevocable copyright license from MITRE to copy, prepare derivative works, publicly perform, publicly display, distribute, and disseminate Common Vulnerabilities and Exposures (CVE). Contact Email: wfi-support@wordfence.com Business Hours Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Support Hours: 24/7 support, 365 days a year, with a 1-hour response time. Other Links Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Social Media Twitter: Link Facebook: Link LinkedIn: Link Instagram: Link Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscription Sign up for news and updates from our panel of experienced security professionals. Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence: Link Other Links View Pricing: Link Create Account: Link Sign In: Link Other Links Have you been hacked? Get Help: Link Other Links Products: Link Intelligence: Link Support: Link News: Link About: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link Other Links Wordfence Intelligence: Link

Goal Reached Thanks to every supporter — we hit 100%!

PrettyLinks <= 3.6.20 Authenticated SQL Injection in 's' Parameter (CVE-2026-5062)

More from this source