Link Whisper Free Vulnerability- Authenticated (Contributor+) PHP Object Injection – CVE-2024-2693 |WordPress Plugin Vulnerability Report

Plugin Name: Link Whisper Free

Key Information:

  • Software Type: Plugin
  • Software Slug: link-whisper
  • Software Status: Active
  • Software Author: linkwhspr
  • Software Downloads: 449,941
  • Active Installs: 30,000
  • Last Updated: March 26, 2024
  • Patched Versions: 0.7.2
  • Affected Versions: <= 0.7.1

Vulnerability Details:

  • Name: Link Whisper Free <= 0.7.1 Authenticated (Contributor+) PHP Object Injection
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • CVE: CVE-2024-2693
  • CVSS Score: 8.8
  • Publicly Published: March 26, 2024
  • Researcher: Francesco Carlucci
  • Description: The Link Whisper Free plugin for WordPress contains a critical vulnerability in versions up to and including 0.7.1, where it fails to securely handle the deserialization of untrusted input in the 'mfn-page-items' post meta value. This flaw allows authenticated users with contributor-level permissions or higher to inject malicious PHP objects. Although the plugin itself lacks a Property-Oriented Programming (POP) chain, the presence of other vulnerable plugins or themes could escalate this to more severe consequences, including arbitrary file deletion, sensitive data exposure, or code execution.


The Link Whisper Free plugin, integral for WordPress sites focusing on enhancing internal linking automatically, has been identified to contain a significant security flaw in versions up to 0.7.1. This vulnerability, centered around PHP Object Injection, could potentially lead to severe site compromises under specific conditions. The issue has been resolved in the latest version, 0.7.2.

Detailed Overview:

This vulnerability was spotlighted by researcher Francesco Carlucci, revealing the plugin's inadequacy in handling serialized data. The potential for exploitation hinges on the presence of a suitable POP chain, possibly introduced through other components within the WordPress installation. The high CVSS score of 8.8 reflects the severity and potential impact of this vulnerability, underscoring the necessity for immediate remedial action.

Advice for Users:

  • Immediate Action: Users are urged to update their Link Whisper Free plugin to version 0.7.2 without delay.
  • Check for Signs of Vulnerability: Regularly review your site for unusual behavior or unauthorized modifications, which might suggest exploitation.
  • Alternate Plugins: Considering the nature of this vulnerability, users may evaluate alternative link management plugins as a precautionary measure.
  • Stay Updated: Maintaining the latest versions of all WordPress components is crucial in defending against known vulnerabilities.


The swift resolution of this vulnerability by the Link Whisper Free development team exemplifies the critical importance of ongoing vigilance and prompt updates in the realm of WordPress site management. To secure WordPress installations against potential threats, users must ensure that they have upgraded to version 0.7.2 or later of the Link Whisper Free plugin.


Detailed Report: 

In our digital world, the security of online platforms is paramount, yet often overlooked until a breach occurs. A recent reminder of this vulnerability came with the discovery of a significant security flaw in the WordPress plugin, Link Whisper Free. Designed to enhance website interconnectivity through intelligent internal linking, this plugin is a favorite among small business owners for its ease of use and powerful functionality. However, the revelation of a critical vulnerability within its codebase has brought to light the ever-present need for vigilance in our digital defenses.

About Link Whisper Free:

Link Whisper Free has been instrumental in optimizing internal linking for WordPress sites, boasting over 449,941 downloads and 30,000 active installations. Its user-friendly interface and AI-driven suggestions have made it a go-to solution for enhancing website SEO and user navigation. Developed by linkwhspr, the plugin's last update was on March 26, 2024, bringing it to version 0.7.2 in response to the discovered vulnerability.

Uncovering the Vulnerability:

The security flaw, tagged as CVE-2024-2693, was a PHP Object Injection vulnerability present in versions up to and including 0.7.1. This issue arose from the plugin's handling of the 'mfn-page-items' post meta value, allowing those with contributor-level access to inject harmful PHP objects. While the plugin itself did not contain a direct Property-Oriented Programming (POP) chain, the presence of other susceptible plugins or themes could escalate the threat to more dire outcomes, such as data breaches or unauthorized code execution.

Potential Risks and Impacts:

The implications of this vulnerability cannot be overstated. For small business owners, a compromised website can lead to significant data loss, erosion of customer trust, and potential financial liabilities. In a landscape where digital presence is often synonymous with business reputation, such security breaches can have lasting impacts.

Remediation and Prevention:

In response to this discovery, the developers of Link Whisper Free swiftly released an update, version 0.7.2, patching the vulnerability. Users of the plugin are urged to update immediately to this latest version to secure their sites. Beyond this immediate step, it's essential to adopt a proactive approach to website maintenance, regularly checking for updates and being aware of any security advisories related to active plugins.

History of Vulnerabilities:

It's noteworthy that this is not the first vulnerability found in Link Whisper Free, with three previous issues reported since May 10, 2023. This history underscores the importance of continuous monitoring and updating of all software components in a WordPress ecosystem.

Staying Ahead of Vulnerabilities:

For small business owners, the digital upkeep of a WordPress site might seem daunting amidst myriad other responsibilities. However, the security of your online platform is integral to your business's credibility and continuity. Leveraging automated tools for updates and security checks can alleviate some of the burdens, but a basic awareness of digital security practices is indispensable. Establishing a routine for digital maintenance, much like any other aspect of your business, can ensure that your online presence remains robust and secure.

In conclusion, the discovery of vulnerabilities like that in Link Whisper Free serves as a critical reminder of the dynamic nature of digital security. Staying informed and responsive to updates and security practices is not just about protecting data; it's about safeguarding the trust your customers place in your digital doorstep. For small business owners, the integrity of your WordPress site is a cornerstone of your digital presence and deserves the same level of attention and care as any other facet of your business.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Link Whisper Free Vulnerability- Authenticated (Contributor+) PHP Object Injection – CVE-2024-2693 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment