A serious security flaw, identified as CVE-2026-4079, has been discovered in the popular SQL Chart Builder plugin for WordPress. This vulnerability allows attackers to gain unauthorized access to your website’s database, potentially leading to the theft of sensitive information, including user credentials.
This issue stems from how the plugin handles user input when building dynamic filters for its charts. If this input isn’t properly checked and cleaned, it can be manipulated by malicious actors to execute harmful commands directly on your database.
CVE Details
- Product: SQL Chart Builder WordPress Plugin
- Published: April 7, 2026
- Severity: High (CVSS: 8.6)
- Status: Analyzed
Affected Products
The vulnerability impacts all versions of the SQL Chart Builder plugin for WordPress prior to version 2.3.8. If you are running an older version, your website is at risk.
Current Status
This vulnerability has been thoroughly analyzed and publicly disclosed. Details, including a proof-of-concept demonstrating how an attack can be performed, are available.
Severity Level
Rated as High severity with a CVSS score of 8.6, this SQL Injection vulnerability poses a significant threat. A successful attack can allow an unauthenticated attacker to inject malicious SQL queries into the plugin’s dynamic filter functionality. This could lead to the extraction of sensitive data, such as administrator usernames and hashed passwords directly from your WordPress database, severely compromising your site’s security.
Possible Solutions
The most critical step to protect your website is to update the SQL Chart Builder plugin immediately. Developers have released a patch:
- Upgrade to Version 2.3.8: Ensure your SQL Chart Builder plugin is updated to version 2.3.8 or a newer release. This version includes the necessary fixes to properly escape user input, preventing SQL Injection attacks.
Beyond this specific patch, it’s always wise to follow general security best practices for your WordPress site:
- Regularly update all themes and plugins to their latest versions.
- Use strong, unique passwords for all user accounts, especially administrators.
- Implement a Web Application Firewall (WAF) to help filter out malicious requests.
- Regularly back up your website’s data.
References
https://wpscan.com/vulnerability/8ec92881-4ae5-458d-995b-f097f2bcc590/
