Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck() method and lack of preparation in the $wpdb->update() call. The vulnerability is compounded by the complete absence of authorization checks and the endpoint being registered for unauthenticated users via wp_ajax_nopriv_. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries and extract sensitive information from the database via time-based blind SQL injection techniques, including administrator password hashes.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-4661](https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/tags/1.7.4/inc/Cla... https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/tags/1.7.4/inc/ClassActions.php#L17 #PatchManagement #Vulnerability #CVE
Post summary
The post announces CVE‑2026‑4661 with a link to plugin source code, but offers no further technical, exploitation, or mitigation details.
CVE-2026-4661 The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all … https://www.cve.org/CVERecord?id=CVE-2026-4661
Post summary
An initial disclosure of a time-based blind SQL Injection flaw in the WP CTA – Sticky CTA Builder WordPress plugin, reported as CVE-2026-4661.