Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

My Sticky Bar plugin for WordPress exposes sensitive data to attackers

CVE-2026-3657
Summary

The My Sticky Bar plugin for WordPress has a security flaw that allows hackers to extract sensitive data from your website's database. If you have this plugin installed, update it to the latest version to fix the issue. This is especially important if your website handles sensitive user data or financial transactions.

Original title
The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler usin...
Original description
The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in `$wpdb->insert()`. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthenticated attackers to inject SQL via crafted parameter names, enabling blind time-based data extraction from the database.
nvd CVSS3.1 7.5
Vulnerability type
CWE-89 SQL Injection
Published: 12 Mar 2026 · Updated: 13 Mar 2026 · First seen: 12 Mar 2026