The SQL Chart Builder WordPress plugin prior to version 2.3.8 contains a SQL Injection vulnerability (CWE-89) due to improper escaping of user input concatenated into SQL queries. This vulnerability affects the dynamic filter feature, potentially allowing attackers to manipulate database queries. The vulnerability was published on April 7, 2026, but no CVSS score or vendor advisory with patch information is available. The plugin is not a cloud service, and no exploits have been reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary SQL commands within the context of the affected WordPress site's database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the attacker's capabilities and database permissions. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the dynamic filter functionality or the plugin itself to reduce exposure. Monitor for vendor updates regarding patches or official mitigations.