CVE-2026-4815: Schiocco Support Board SQLi Vulnerability

CVE-2026-4815 Overview

A SQL Injection vulnerability has been identified in Schiocco Support Board v3.7.7, a WordPress plugin used for customer support functionality. This vulnerability allows authenticated attackers to manipulate database operations through the calls[0][message_ids][] parameter in the /supportboard/include/ajax.php endpoint. Successful exploitation enables attackers to retrieve, create, update, and delete database records, potentially compromising the entire WordPress installation and its underlying data.

Critical Impact

Attackers with low-level privileges can execute arbitrary SQL queries to extract sensitive data, modify database contents, or completely delete critical information from affected Support Board installations.

Affected Products

• Schiocco Support Board v3.7.7
• Support Board WordPress Plugin (prior vulnerable versions)
• WordPress installations using vulnerable Support Board versions

Discovery Timeline

• 2026-03-25 - CVE-2026-4815 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-4815

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists in the Support Board WordPress plugin's AJAX handler. The vulnerability is network-accessible and requires only low-privilege authentication to exploit. The flaw occurs when user-supplied input through the calls[0][message_ids][] parameter is incorporated into SQL queries without proper sanitization or parameterization.

The vulnerability affects the confidentiality, integrity, and availability of the system by allowing unauthorized database operations. An attacker can leverage this flaw to bypass application-level access controls and directly interact with the underlying MySQL database. This could lead to extraction of user credentials, customer support conversation data, personal information, and potentially WordPress administrator credentials stored in the database.

Root Cause

The root cause of this vulnerability is improper input validation and the lack of parameterized queries (prepared statements) in the ajax.php endpoint. The calls[0][message_ids][] parameter accepts user input that is directly concatenated or interpolated into SQL query strings without adequate escaping or sanitization. This classic SQL Injection pattern allows attackers to break out of the intended query context and inject malicious SQL commands.

Attack Vector

The attack is conducted over the network by sending specially crafted HTTP requests to the /supportboard/include/ajax.php endpoint. The attacker must have at least low-level authentication to the WordPress site or Support Board application. By manipulating the calls[0][message_ids][] array parameter, an attacker can inject SQL syntax that alters the query logic.

Typical attack payloads might include UNION-based injection to extract data from other tables, boolean-based blind injection to enumerate database contents, or stacked queries (if supported) to perform INSERT, UPDATE, or DELETE operations. The vulnerability allows full database manipulation including reading sensitive tables such as wp_users, modifying user roles, or deleting support ticket records.

Detection Methods for CVE-2026-4815

Indicators of Compromise

• Unusual or malformed HTTP POST requests to /supportboard/include/ajax.php containing SQL syntax in the calls[0][message_ids][] parameter
• Database logs showing unexpected queries with UNION, SELECT, INSERT, UPDATE, or DELETE statements originating from the Support Board plugin
• Anomalous database access patterns such as bulk data extraction or unauthorized table reads
• Error messages in application logs indicating SQL syntax errors from malformed injection attempts

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to inspect and block requests containing SQL injection patterns in the message_ids parameter
• Enable detailed logging on the /supportboard/include/ajax.php endpoint and monitor for suspicious parameter values
• Implement database query monitoring to detect anomalous SQL statements executed by the Support Board plugin
• Use SentinelOne Singularity to monitor for web shell deployments or post-exploitation activity following SQL injection attacks

Monitoring Recommendations

• Configure real-time alerts for HTTP requests containing common SQL injection keywords (UNION, SELECT, INSERT, DROP, etc.) targeting Support Board endpoints
• Monitor WordPress database for unauthorized changes to user accounts or privilege escalations
• Review access logs for repeated requests to ajax.php with varying parameter payloads, which may indicate injection testing
• Enable database audit logging to track all queries executed against sensitive tables

How to Mitigate CVE-2026-4815

Immediate Actions Required

• Audit your WordPress installations to identify if Schiocco Support Board v3.7.7 or earlier is installed
• Restrict access to the Support Board plugin administrative functions to trusted users only
• Implement Web Application Firewall rules to filter SQL injection attempts targeting the vulnerable endpoint
• Consider temporarily disabling the Support Board plugin until a patch is available if it is not business-critical
• Review database access logs for any signs of prior exploitation

Patch Information

As of the last update to this CVE, no official vendor patch information has been published. Monitor the INCIBE Security Notice for updates regarding security patches from Schiocco. Users should check for plugin updates through the WordPress plugin repository and apply any security releases as soon as they become available.

Workarounds

• Implement input validation at the application layer or via a reverse proxy to sanitize the calls[0][message_ids][] parameter
• Deploy a WAF with SQL injection protection rules specifically targeting the /supportboard/include/ajax.php endpoint
• Restrict network access to the vulnerable endpoint using IP allowlisting if remote access is not required
• Apply the principle of least privilege to database users associated with the WordPress installation to limit the impact of SQL injection

# Example: Apache mod_rewrite rule to block suspicious requests to the vulnerable endpoint
# Add to .htaccess in the WordPress root directory

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (union|select|insert|update|delete|drop|concat|information_schema) [NC]
    RewriteCond %{REQUEST_URI} /supportboard/include/ajax\.php [NC]
    RewriteRule .* - [F,L]
</IfModule>