Attack Chain

1. An unauthenticated attacker identifies a WordPress instance running the vulnerable "WP CTA - Sticky CTA Builder, Generate Leads, Promote Sales" plugin.
2. The attacker sends an HTTP POST request to the wp-admin/admin-ajax.php endpoint, specifying action=cta_ajax_check to invoke the vulnerable function.
3. The attacker injects a time-based blind SQL injection payload into the fildname parameter within the POST request.
4. The server processes the malicious SQL query embedded in fildname, causing a noticeable delay in the HTTP response due to functions like SLEEP() or BENCHMARK().
5. By observing these time delays, the attacker iteratively infers database schema information, including table names and column names.
6. The attacker crafts subsequent time-based payloads to progressively extract sensitive data, such as entries from the wp_users table.
7. Specifically, the attacker targets and extracts administrator password hashes, potentially enabling offline cracking or credential stuffing attacks.
8. Successful exploitation culminates in the exfiltration of sensitive database contents and potential full administrative control over the WordPress site.

Impact

Successful exploitation of CVE-2026-4661 allows unauthenticated attackers to extract arbitrary sensitive data directly from the WordPress database. The most critical impact is the potential exfiltration of administrator password hashes, which can then be used to gain full control over the compromised website. This could lead to website defacement, injection of malicious content, complete data loss, or further exploitation of site visitors. Organizations using the vulnerable plugin face significant risks of data breaches, reputational damage, and operational disruption. The unauthenticated nature of the vulnerability means any exposed WordPress site running the plugin is a potential target.

Recommendation

• Patch CVE-2026-4661 by updating the "WP CTA - Sticky CTA Builder, Generate Leads, Promote Sales" plugin to a version greater than 2.2.2 immediately.
• Deploy the Sigma rule in this brief to your SIEM and tune for your environment to detect exploitation attempts against CVE-2026-4661.
• Review web server logs for suspicious HTTP POST requests to /wp-admin/admin-ajax.php containing SQL injection payloads in the fildname parameter as described in the attack chain.