What is the CVSS score of CVE-2026-4661?

CVE-2026-4661 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of WP CTA are affected by CVE-2026-4661?

The WP CTA WordPress plugin (versions ≤2.2.2) contains an unauthenticated SQL injection vulnerability enabling remote attackers to extract administrator password hashes and sensitive database…

How to fix or mitigate CVE-2026-4661?

24 hours: Identify all WordPress instances running WP CTA plugin and determine current versions in use; assess scope and business criticality. 7 days: Disable or uninstall the vulnerable plugin across all systems; implement WAF rules to block malicious requests to the ajaxCheck() endpoint with 'fildname' parameter injection; enable database activity monitoring for unauthorized access attempts. 30 days: Deploy alternative CTA solution without known vulnerabilities; force password reset for all WordPress administrator accounts; review database access logs for evidence of prior exploitation or credential disclosure.

WP CTA CVE-2026-4661

EUVD-2026-43157 HIGH

SQL Injection (CWE-89)

2026-07-11 Wordfence

GHSA-w7rc-p2m9-r4pm

WordPress SQLi Wordpress Plugin Wp Cta Call Now Button Sticky Button Call To Action Builder

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network AJAX endpoint (AV:N/AC:L/PR:N/UI:N) with blind SQLi enabling full DB read (C:H); described impact is extraction only, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 06:52 vuln.today

CVE Published

Jul 11, 2026 - 05:35 cve.org

HIGH 7.5

DescriptionCVE.org

The WP CTA - Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck() method and lack of preparation in the $wpdb->update() call. The vulnerability is compounded by the complete absence of authorization checks and the endpoint being registered for unauthenticated users via wp_ajax_nopriv_. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries and extract sensitive information from the database via time-based blind SQL injection techniques, including administrator password hashes.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 16 High Severity Jul 12, 2026

AnalysisAI

Unauthenticated SQL injection in the WP CTA (Sticky CTA Builder / Call Now Button) WordPress plugin through version 2.2.2 lets remote attackers extract database contents - including administrator password hashes - via the 'fildname' parameter of the ajaxCheck() AJAX endpoint. Because the handler is registered through wp_ajax_nopriv_ and performs no capability or nonce checks, exploitation requires no login. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is trivially reachable and reported by Wordfence.

Technical ContextAI

The affected component is a WordPress plugin (CPE vendor 'blendmedia') that exposes an admin-ajax.php action for its sticky call-to-action feature. The root cause is CWE-89 (SQL Injection): the ajaxCheck() method takes a user-supplied column name via the 'fildname' parameter and concatenates it into a $wpdb->update() call without escaping and without using $wpdb->prepare(). Column/identifier names cannot be parameterized by prepare() the same way values can, so developers must whitelist them against a fixed set - this plugin does neither, allowing the identifier position of the query to be manipulated. Combined with registration under wp_ajax_nopriv_ (which makes the action callable by logged-out visitors), the injection is fully pre-authentication.

RemediationAI

No vendor-released patched version is stated in the available data; an upstream fix appears to exist via the WordPress plugin SVN changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3524743%40easy-sticky-sidebar&new=3524743%40easy-sticky-sidebar) but a released patched tag is not independently confirmed, so update to the latest available version and monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/7e963601-dc41-4218-9119-708c74e51bc2?source=cve) for a fixed release above 2.2.2. Until a confirmed patch is installed, deactivate and remove the plugin if the sticky-CTA feature is non-essential (fully removes exposure but loses the CTA functionality); if it must stay, place a WAF rule or virtual patch blocking requests to admin-ajax.php that carry the vulnerable action with a 'fildname' parameter, and restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible (may break other legitimate front-end AJAX). Rotate all WordPress administrator passwords and any reused credentials after patching, since hash theft may already have occurred.