CVE-2025-22306: Link Whisper Information Disclosure Flaw

CVE-2025-22306 Overview

CVE-2025-22306 is a sensitive information disclosure vulnerability in the Link Whisper Free WordPress plugin developed by Spencer Haws. The flaw affects all versions up to and including 0.7.7. The vulnerability falls under [CWE-538]: Insertion of Sensitive Information into Externally-Accessible File or Directory. An unauthenticated remote attacker can access sensitive data stored in plugin-controlled files without authentication or user interaction. The issue is network-exploitable and requires no privileges, though impact is limited to confidentiality.

Critical Impact
Unauthenticated attackers can retrieve sensitive plugin data from externally-accessible files on affected WordPress sites running Link Whisper Free <= 0.7.7.

Affected Products

Spencer Haws Link Whisper Free plugin for WordPress
All versions from initial release through 0.7.7
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2025-01-07 - CVE-2025-22306 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22306

Vulnerability Analysis

The Link Whisper Free plugin stores or exposes sensitive information in a location reachable over the public web. Because the file or directory is externally accessible, any remote client can request the resource without authenticating to WordPress. The plugin does not enforce access controls that would restrict retrieval to authorized users. Attackers exploit this by issuing direct HTTP requests to the exposed path served by the WordPress instance.

The vulnerability affects confidentiality only. Attackers cannot modify data or disrupt service through this flaw alone. However, disclosed information may include configuration data, internal identifiers, or content that supports follow-on attacks against the site or its users.

Root Cause

The root cause is [CWE-538]: Insertion of Sensitive Information into Externally-Accessible File or Directory. The plugin writes sensitive data to a location under the WordPress web root, or fails to protect that location with directory-level restrictions such as .htaccess rules, index files, or capability checks. As a result, the data is reachable by anyone who knows or guesses the URL path.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker enumerates or requests the known plugin path, retrieves the exposed file, and parses its contents. No authentication, user interaction, or elevated privileges are needed. The Patchstack advisory documents the exposure path and confirms the pre-authenticated nature of the issue.

Refer to the Patchstack Vulnerability Report for the specific file path and disclosure details.

Detection Methods for CVE-2025-22306

Indicators of Compromise

Unauthenticated HTTP GET requests to Link Whisper plugin paths under /wp-content/plugins/link-whisper/
Repeated requests from a single source enumerating files within the plugin directory
Anomalous outbound access to plugin-generated files not typically requested by legitimate users
User-agent strings associated with automated WordPress vulnerability scanners

Detection Strategies

Inspect web server access logs for direct requests to Link Whisper plugin files that return HTTP 200 responses
Deploy web application firewall (WAF) rules that flag or block access to sensitive plugin file paths
Correlate scanner activity across multiple WordPress endpoints to identify targeted enumeration campaigns

Monitoring Recommendations

Monitor WordPress plugin inventory to identify sites running Link Whisper Free <= 0.7.7
Alert on HTTP requests to plugin-controlled data files that originate from external IP addresses
Track response sizes and content types returned from plugin directories to detect data exfiltration patterns

How to Mitigate CVE-2025-22306

Immediate Actions Required

Identify all WordPress instances running the Link Whisper Free plugin and inventory installed versions
Update the plugin to a version later than 0.7.7 once the vendor releases a patched build
Restrict web-accessible paths under the plugin directory using web server rules until a fix is available
Review server access logs for prior unauthorized requests to plugin data files

Patch Information

As of the last NVD update on 2026-06-17, the advisory lists affected versions as <= 0.7.7. Consult the Patchstack Vulnerability Report and the WordPress.org plugin page for the current fixed version. Apply the vendor-supplied update through the WordPress admin console or via wp-cli.

Workarounds

Deactivate and remove the Link Whisper Free plugin until a patched version is installed
Add web server rules blocking direct HTTP access to sensitive files under /wp-content/plugins/link-whisper/
Deploy a WAF signature that denies requests matching the disclosed file path documented by Patchstack

bash

# Example Apache rule to block direct access to plugin data files
<Directory "/var/www/html/wp-content/plugins/link-whisper">
    <FilesMatch "\.(log|json|txt|csv)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/plugins/link-whisper/.*\.(log|json|txt|csv)$ {
    deny all;
    return 403;
}