CVE-2026-4661 is a high-severity SQL Injection vulnerability affecting the WP CTA – Call Now Button, Sticky Button & Call to Action Builder WordPress plugin up to version 2.2.2. The issue is due to improper neutralization of special elements in SQL commands (CWE-89) via the 'fildname' parameter in the ajaxCheck() method. The plugin fails to properly escape user-supplied column names and does not prepare the $wpdb->update() call securely. Additionally, the affected AJAX endpoint is accessible to unauthenticated users (registered via wp_ajax_nopriv_) and lacks authorization checks, enabling attackers to perform time-based blind SQL injection attacks to extract sensitive database information, including administrator password hashes.

An unauthenticated attacker can exploit this vulnerability to perform time-based blind SQL injection attacks, allowing extraction of sensitive information from the database such as administrator password hashes. This compromises the confidentiality of the affected WordPress site’s data. The vulnerability does not impact integrity or availability directly but poses a significant risk to data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable AJAX endpoint if possible and monitor for suspicious activity. Avoid using affected versions (<=2.2.2) of the plugin in production environments. Follow vendor updates closely for an official patch or mitigation.