CVE-2026-3657 describes an SQL injection vulnerability in the My Sticky Bar plugin for WordPress, affecting all versions up to 2.8.6. The vulnerability occurs because the plugin uses attacker-controlled POST parameter keys directly as column names in a $wpdb->insert() SQL statement without sanitization, while only sanitizing parameter values. This improper neutralization of special elements (CWE-89) enables unauthenticated attackers to inject SQL code via crafted parameter names, potentially extracting data through blind time-based techniques. The CVSS 3.1 score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An unauthenticated attacker can exploit this vulnerability to perform blind time-based SQL injection attacks, potentially extracting sensitive data from the WordPress database. The impact affects confidentiality but does not affect integrity or availability. Exploitation does not require authentication or user interaction, increasing the risk of remote compromise. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor for updates from the plugin vendor (premio). Until a fix is available, consider disabling the affected AJAX action or the plugin if feasible to reduce exposure. Avoid relying on generic mitigations as the vulnerability specifically involves unsanitized SQL column identifiers.