Junglewise Threat Intelligence

CVE-2026-4661: WordPress WP CTA Plugin blind SQL injection in ajaxCheck

CVE-2026-4661 · Severity: high · CVSS 7.5 · Published 2026-07-11

Executive brief

The WP CTA plugin for WordPress, which is used to create call-to-action buttons and lead generation tools, contains a security flaw that allows unauthorized individuals to access the website's database. By exploiting this vulnerability, an attacker can extract sensitive information, such as administrator password hashes, without needing to log in. This could lead to a full takeover of the affected website and the exposure of customer or operational data.

Technical details

The WP CTA plugin for WordPress is vulnerable to time-based blind SQL injection due to insufficient escaping of user-supplied column names in the ajaxCheck() method and a lack of proper preparation in the $wpdb->update() call. The vulnerability is accessible to unauthenticated users because the affected endpoint is registered via wp_ajax_nopriv_ and lacks any authorization checks. An attacker can send crafted requests to the 'fildname' parameter to execute arbitrary SQL queries. This enables the extraction of sensitive data from the database, such as administrator password hashes, by observing the time delay in the server's response. The issue affects all versions up to and including 2.2.2.

Affected products

  • blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder <= 2.2.2

Timeline

  • 2026-07-11: disclosed: Vulnerability published by Wordfence and NVD.

References

Related threats