CVE-2026-4661 Overview
CVE-2026-4661 is a time-based blind SQL Injection vulnerability [CWE-89] affecting the WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress. The flaw exists in all versions up to and including 2.2.2. The vulnerability originates from insufficient escaping of the fildname parameter in the ajaxCheck() method and lack of preparation in the $wpdb->update() call. The endpoint is registered via wp_ajax_nopriv_, exposing it to unauthenticated users with no authorization checks. Attackers can extract sensitive database contents, including administrator password hashes, without credentials.
Critical Impact
Unauthenticated remote attackers can extract arbitrary database contents, including WordPress administrator password hashes, via time-based blind SQL injection.
Affected Products
- WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales WordPress plugin
- All versions up to and including 2.2.2
- WordPress sites with the easy-sticky-sidebar plugin installed and activated
Discovery Timeline
- 2026-07-11 - CVE-2026-4661 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-4661
Vulnerability Analysis
The vulnerability resides in the plugin's ajaxCheck() AJAX handler. The handler accepts a user-supplied fildname parameter representing a database column name. That value is passed directly into a $wpdb->update() call without escaping or use of prepared statements. Because column identifiers cannot be parameterized with $wpdb->prepare(), the plugin must strictly whitelist or sanitize allowed column names, which it does not.
Compounding the input-handling defect, the AJAX endpoint is registered using wp_ajax_nopriv_, making it reachable by unauthenticated visitors. The handler performs no capability, nonce, or authorization checks. Attackers can therefore submit crafted fildname payloads that break the SQL statement context and inject conditional time-delay primitives such as SLEEP() or BENCHMARK() to infer data byte-by-byte.
Root Cause
Two defects combine to create the flaw. First, the plugin trusts the fildname value as a SQL column identifier without validation or whitelisting. Second, the wp_ajax_nopriv_ registration exposes the sink to anonymous requests. The result is classic CWE-89 SQL injection via an identifier position that cannot be safely parameterized.
Attack Vector
Exploitation requires only network access to a public WordPress site running the vulnerable plugin. An attacker sends a POST request to admin-ajax.php invoking the plugin's action and supplies a malicious fildname value containing SQL fragments. By measuring response latency correlated to conditional SLEEP execution, the attacker enumerates database contents including the wp_users table and user_pass hashes. See the Wordfence Vulnerability Report and the WordPress Changeset Details for the corrected code paths.
Detection Methods for CVE-2026-4661
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing the plugin's AJAX action and a fildname parameter with SQL keywords such as SLEEP, BENCHMARK, IF(, SELECT, or backticks.
- Repeated requests from a single source with response times clustered at multiples of a fixed delay value, indicating time-based inference.
- Unexpected outbound activity or new administrator accounts following a spike in admin-ajax.php traffic.
Detection Strategies
- Deploy Web Application Firewall (WAF) rules that inspect fildname and other identifier-position parameters for SQL metacharacters.
- Alert on admin-ajax.php requests where the response time exceeds a baseline threshold, particularly when correlated with unauthenticated sessions.
- Review WordPress access logs for high-volume requests targeting the plugin's AJAX action from a single IP.
Monitoring Recommendations
- Enable query logging on the WordPress database and inspect for malformed UPDATE statements referencing unexpected column names.
- Monitor for changes to the wp_users and wp_options tables, and audit administrator account creation events.
- Track plugin inventory and version drift across WordPress deployments to identify hosts still running versions at or below 2.2.2.
How to Mitigate CVE-2026-4661
Immediate Actions Required
- Update the WP CTA – Sticky CTA Builder plugin to a version newer than 2.2.2 as soon as the vendor releases a fixed build.
- If a patched version is unavailable, deactivate and remove the plugin from all affected WordPress installations.
- Rotate all WordPress administrator passwords and invalidate active sessions, assuming password hashes may have been exfiltrated.
Patch Information
Refer to the vendor's WordPress Changeset Details for the corrective commit and to the Wordfence Vulnerability Report for fixed version guidance. The fix must enforce a strict allowlist on column identifiers passed to $wpdb->update() and require authentication plus nonce validation on the AJAX endpoint.
Workarounds
- Block requests to admin-ajax.php where the action parameter matches the plugin's handler using a WAF rule until a patch is applied.
- Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible, or require authentication at the reverse proxy.
- Apply a virtual patch that rejects any request whose fildname value does not match a strict allowlist of expected column names (for example, alphanumeric and underscore only).
# Example ModSecurity rule blocking suspicious fildname payloads
SecRule ARGS:fildname "@rx (?i)(sleep|benchmark|select|union|--|;|`|\\()" \
"id:1026466101,phase:2,deny,status:403,\
msg:'CVE-2026-4661 WP CTA fildname SQLi attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
