CVE-2026-56738: phpMyFAQ SQL injection in StopWords::add()

CVE-2026-56738 · Severity: high · CVSS 4 · Published 2026-09-24

phpMyFAQ is a popular FAQ management system used by organizations to publish knowledge bases and support documentation. An authenticated administrator can inject SQL code through the stop-words feature to read, modify, or delete database records—including sensitive data like user credentials and FAQ content—or cause service outages. The vulnerability exists because user input is not properly escaped before being inserted into a database query.

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-56738 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56738 being exploited in the wild.
How severe is CVE-2026-56738?
High severity, with a CVSS score of 4, published 24 September 2026.
Which products and versions are affected?
phpmyfaq/phpmyfaq (Packagist) <= 4.1.5, ECOSYSTEM:introduced=0,fixed=4.1.6; thorsten/phpmyfaq (Packagist) <= 4.1.5, ECOSYSTEM:introduced=0,fixed=4.1.6.
Is there a fix for CVE-2026-56738?
Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.6 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56738 attacked?
It is attacked over the network.
Am I affected by CVE-2026-56738?
Check whether you run phpmyfaq/phpmyfaq (Packagist) or thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.6 or later
    composer require phpmyfaq/phpmyfaq:^4.1.6
  • thorsten/phpmyfaq (Packagist): upgrade to 4.1.6 or later
    composer require thorsten/phpmyfaq:^4.1.6

Technical details

The vulnerability is a SQL injection flaw in the `StopWords::add()` method in phpMyFAQ, where a stop-word value is inserted directly into a SQL query via `sprintf()` without calling the database escape function, while the identical `StopWords::update()` method correctly applies escaping to the same input type. An authenticated administrator reaching the stop-word management interface can craft a malicious stop word (e.g., `test', 'en'); DROP TABLE faqstopwords; --`) that breaks out of the SQL string literal and executes arbitrary SQL statements. Attack precondition is valid administrator credentials or an authenticated admin session; exploitation allows UNION-based and blind SQL injection to exfiltrate data, modify records, or drop tables depending on database user permissions and driver capabilities. The recommended fix is to apply the same escaping pattern already used elsewhere in the file, or migrate to parameterized prepared statements for defense in depth.

Affected products

  • phpMyFAQ phpMyFAQ <unknown

Identifiers

  • CVE-2026-56738
  • GHSA-rw77-vq4g-x3hp

Timeline

  • 2026-09-24: disclosed
  • 2026: other: CVE-2026-56738 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.