CVE-2026-5062: PrettyLinks WordPress Plugin SQLi Vulnerability

CVE-2026-5062 Overview

CVE-2026-5062 is an authenticated SQL injection vulnerability in the Pretty Links WordPress plugin, marketed as "PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin." The flaw affects all plugin versions up to and including 3.6.20. The s (search) parameter on the Pretty Links listing page is passed to the search_links_table() function without adequate escaping or prepared statement usage. Attackers holding Administrator privileges or higher can append arbitrary SQL clauses to the underlying query and extract data from the WordPress database. The issue is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated administrators can execute injected SQL against the WordPress database, exposing user records, hashed credentials, session tokens, and plugin-stored data such as affiliate and Stripe integration details.

Affected Products

Pretty Links WordPress plugin (pretty-link) versions up to and including 3.6.20
WordPress sites running the affected plugin with users at Administrator role or above
Multi-site WordPress installations where the plugin is network-activated

Discovery Timeline

2026-08-05 - CVE-2026-5062 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-5062

Vulnerability Analysis

The vulnerability resides in the search_links_table() function inside app/controllers/PrliLinksController.php. When an authenticated user submits a search query on the Pretty Links listing page, the value of the s HTTP parameter is concatenated into a SQL statement without being escaped through wpdb::prepare() or esc_sql(). The dynamic query is then executed directly against the WordPress database.

Because the injected content is placed inside an existing SELECT statement, an attacker can append UNION SELECT clauses or terminate the query and enumerate arbitrary tables. The exploit requires Administrator-level authentication, which limits the population of eligible attackers but remains relevant on multi-admin sites, compromised admin accounts, or scenarios involving privilege abuse by insiders.

Root Cause

The root cause is missing input sanitization combined with unparameterized SQL construction. The controller code accepts the user-supplied s value and interpolates it into the query string rather than binding it as a parameter. See the vulnerable lines referenced in the Pretty Link source at line 1047 and line 1051.

Attack Vector

An authenticated administrator issues a crafted request to the Pretty Links admin listing endpoint with a malicious s parameter. The payload closes the original expression and appends a secondary query targeting sensitive tables such as wp_users or wp_usermeta. The resulting rows are returned in the listing response or through error-based extraction, exposing database contents to the attacker. For technical details, see the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-5062

Indicators of Compromise

Requests to WordPress admin pages containing SQL keywords such as UNION, SELECT, SLEEP, or information_schema inside the s query parameter
Anomalous administrator-session requests to the Pretty Links listing page with unusually long or encoded search values
Unexpected database errors logged by WordPress or the underlying MySQL/MariaDB instance originating from PrliLinksController.php
Outbound data spikes from the web server after Pretty Links admin activity

Detection Strategies

Enable WordPress query logging or a Web Application Firewall (WAF) rule that inspects the s parameter on wp-admin requests to Pretty Links pages for SQL syntax
Correlate administrator logins with subsequent access to the Pretty Links listing endpoint to spot compromised or abused admin accounts
Deploy endpoint and workload monitoring on the underlying web host to detect anomalous PHP-to-database query patterns

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a centralized SIEM or data lake for query-parameter inspection
Alert on administrator role assignments, password resets, and new admin creations following suspicious plugin access
Track plugin version inventory across all WordPress instances to identify hosts still running Pretty Links 3.6.20 or earlier

How to Mitigate CVE-2026-5062

Immediate Actions Required

Update the Pretty Links plugin to the patched version released after 3.6.20; review the fix in the Pretty Link changeset
Audit all Administrator accounts, remove unused privileged users, and enforce multi-factor authentication for remaining admins
Rotate WordPress secrets in wp-config.php and reset administrator passwords if unauthorized listing-page access is suspected

Patch Information

The vendor released a fix that replaces the unsafe string interpolation in search_links_table() with prepared statements. The change is visible in the referenced Trac changeset between the vulnerable tag 3.6.20 and the patched trunk revision. Site owners should upgrade through the WordPress plugin manager or by deploying the patched plugin ZIP.

Workarounds

Restrict access to /wp-admin/ by source IP where feasible to limit exposure of the vulnerable admin endpoint
Deploy a WAF rule that blocks SQL metacharacters in the s parameter on Pretty Links admin URLs until patching is complete
Temporarily deactivate the Pretty Links plugin on sites that cannot be updated immediately

bash

# Update Pretty Links via WP-CLI once the fixed version is available
wp plugin update pretty-link --version=<patched-version>

# Verify the installed version is no longer 3.6.20 or earlier
wp plugin get pretty-link --field=version