This vulnerability (CVE-2026-46364) affects phpMyFAQ before version 4.1.2 and involves improper neutralization of special elements in SQL commands, specifically in the BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods. Unsanitized User-Agent headers are directly interpolated into SQL DELETE and INSERT queries, allowing unauthenticated attackers to exploit the GET /api/captcha endpoint via time-based blind SQL injection. Successful exploitation can lead to extraction of sensitive database information including user credentials, administrative tokens, and SMTP credentials. The vulnerability is rated critical with a CVSS 3.1 score of 9.8, reflecting its high impact on confidentiality, integrity, and availability. No patch or official fix has been confirmed as of the published date.

An unauthenticated attacker can exploit this SQL injection vulnerability to perform time-based blind SQL injection attacks against the phpMyFAQ database. This can result in unauthorized disclosure of sensitive information such as user credentials, admin tokens, and SMTP credentials. The vulnerability affects confidentiality, integrity, and availability of the application and its data, making it critical. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint or implementing web application firewall (WAF) rules to detect and block suspicious User-Agent header patterns targeting the /api/captcha endpoint. Avoid exposing the vulnerable phpMyFAQ versions to untrusted networks.