WP CTA CVE-2026-4661

Exploitation requires only that the WP CTA plugin (any version ≤2.2.2) is installed and active on a reachable WordPress site; the vulnerable ajaxCheck() action is registered via wp_ajax_nopriv_, so no account, nonce, or user interaction is needed and it works against default configurations. The concrete prerequisite is the 'fildname' request parameter reaching the unsanitized $wpdb->update() column position. Practical limiting factors: extraction uses time-based blind techniques, which are slow, timing-sensitive (unreliable on high-latency or heavily-loaded servers), and generate many repetitive requests that rate-limiting or WAFs can throttle or detect; impact is confidentiality-only (read/exfiltration), with no direct code execution or data modification indicated.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, no-privilege, no-interaction attack with high confidentiality impact and no integrity/availability impact - consistent with time-based blind data exfiltration. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so real-world exploitation cannot be confirmed from the input. The gap between an easily-reachable unauthenticated SQLi (which historically attracts automated mass-scanning against WordPress) and the absence of any exploitation signal likely reflects that this is a recently disclosed, lower-profile plugin rather than evidence of low risk. Time-based blind extraction is slow and noisy, which slightly raises detection odds and lowers automation efficiency, but the technical impact (theft of admin hashes) is severe. Treat as a real priority for any site running this plugin; deprioritize only where the plugin is absent.

An attacker discovers a WordPress site running WP CTA ≤2.2.2 and sends crafted unauthenticated POST requests to admin-ajax.php invoking ajaxCheck() with a malicious 'fildname' value containing a time-delay SQL payload (e.g. a conditional SLEEP). By observing response timing, they iteratively extract the wp_users table one character at a time, recovering admin password hashes for offline cracking or credential reuse. No POC is published, but the attack needs only an HTTP client and knowledge of the endpoint.