CVE-2026-5062

Name of the Vulnerable Software and Affected Versions PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin versions prior to 3.6.21

Description An issue exists where authenticated attackers with Administrator-level access and above can perform SQL Injection. This occurs via the 's' parameter on the Pretty Links listing page due to insufficient escaping of user-supplied input and lack of preparation in the SQL query within the search links table() function. This allows the execution of additional SQL queries to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 3.6.20. As a temporary mitigation, restrict access to the Pretty Links listing page or avoid using the s parameter until the update is applied.