CVE-2026-46364 is an unauthenticated SQL injection vulnerability affecting phpMyFAQ versions prior to 4.1.2. The flaw exists in the BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods, which incorporate unsanitized User-Agent HTTP headers into SQL DELETE and INSERT statements. Attackers can exploit this by sending malicious User-Agent headers to the GET /api/captcha endpoint, enabling time-based blind SQL injection attacks. This allows extraction of sensitive database information including user credentials, administrative tokens, and SMTP credentials. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8. No patch or official remediation is currently documented, and the product is not a cloud service.

Successful exploitation of this vulnerability allows unauthenticated attackers to perform time-based blind SQL injection attacks against the phpMyFAQ database. This can lead to unauthorized disclosure of sensitive information such as user credentials, admin tokens, and SMTP credentials. The impact includes full confidentiality, integrity, and availability compromise of the affected system's database. Given the critical CVSS score of 9.8, the vulnerability poses a severe risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the /api/captcha endpoint or implementing web application firewall (WAF) rules to block malicious User-Agent headers targeting this endpoint. Monitoring for unusual traffic patterns to this API may also help detect exploitation attempts. Avoid exposing vulnerable versions of phpMyFAQ to untrusted networks.