What the vulnerability does
01Description
The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in `$wpdb->insert()`. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthenticated attackers to inject SQL via crafted parameter names, enabling blind time-based data extraction from the database.
Explanation of Vulnerability in Simple Terms
02Summary
My Sticky Bar versions 2.8.6 and earlier contain a SQL injection vulnerability in how they process user input. An attacker on the network can craft a malicious request to extract sensitive data from the site's database without needing to log in or interact with a user. This affects the confidentiality of stored information.
What an attacker can do
03Attacker Capabilities
Extract sensitive data from the site's database by injecting SQL commands into vulnerable parameters.
Potential impact on your site
04Site Impact
Attackers can read database contents including user credentials, posts, and configuration data without logging in.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
March 12, 2026
CVE published
April 8, 2026
Record updated
