What is the CVSS score of CVE-2026-3657?

CVE-2026-3657 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3657?

WordPress sites using the My Sticky Bar plugin (versions up to 2.8.6) are vulnerable to SQL injection attacks that could allow unauthorized database access or manipulation.

How to fix or mitigate CVE-2026-3657?

Within 24 hours: Audit all WordPress installations for My Sticky Bar plugin presence and version; disable the plugin's contact form AJAX functionality if the plugin is in use. Within 7 days: Either remove the plugin entirely, upgrade to a patched version if released, or implement WAF rules blocking POST requests to the stickymenu_contact_lead_form AJAX action. Within 30 days: Complete replacement with an alternative contact form solution and validate all database activity logs for exploitation signs.

WordPress CVE-2026-3657

HIGH

SQL Injection (CWE-89)

2026-03-12 security@wordfence.com

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 03:15 nvd

HIGH 7.5

DescriptionCVE.org

The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the stickymenu_contact_lead_form AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in $wpdb->insert(). While parameter values are sanitized with esc_sql() and sanitize_text_field(), the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthenticated attackers to inject SQL via crafted parameter names, enabling blind time-based data extraction from the database.

AnalysisAI

Unauthenticated SQL injection in WordPress My Sticky Bar plugin versions up to 2.8.6 allows attackers to extract database contents through crafted AJAX requests that exploit unsanitized parameter names in SQL INSERT statements. The vulnerability enables blind time-based data exfiltration despite sanitization of parameter values, affecting all users of the vulnerable plugin. No patch is currently available.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the crafted component of My Sticky Bar (WordPress plugin). The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the stickymenu_contact_lead_form AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in $wpdb->insert(). While parameter values are sanitized with esc_sql() and sanitize_text_field(), the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthent

Affected ProductsAI

Vendor: WordPress. Product: My Sticky Bar (WordPress plugin). Component: crafted.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.