CVE-2026-4079

OVERVIEW CVE-2026-4079 is a SQL Injection vulnerability in the SQL Chart Builder WordPress plugin versions prior to 2.3.8. The vulnerability exists in the dynamic filter functionality where user input is improperly escaped before being concatenated into SQL queries, allowing attackers to inject malicious SQL code. SEVERITY The vulnerability has a CVSS score of 6.5 (Medium) with a network-based attack vector requiring no privileges or user interaction. While the attack complexity is low, the impact is limited to confidentiality and integrity breaches with no availability impact. The EPSS score of 0.00029 indicates this vulnerability is not currently prevalent in the wild relative to other CVEs. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is classified as inactive on the Hot List, suggesting minimal community attention or public exploit availability. Organizations should prioritize updating to version 2.3.8 or later, but this is not an urgent threat requiring immediate emergency patching based on current threat intelligence.