CVE-2026-46364
Published: 15 May 2026
Summary
CVE-2026-46364 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
phpMyFAQ versions prior to 4.1.2 contain an unauthenticated SQL injection vulnerability tracked as CVE-2026-46364 and assigned CWE-89. The flaw resides in the BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods, which directly interpolate unsanitized User-Agent header values into DELETE and INSERT SQL statements. The affected code path is reachable through the public GET /api/captcha endpoint without requiring authentication or user interaction.
Unauthenticated remote attackers can supply a crafted User-Agent header to the captcha endpoint and perform time-based blind SQL injection. Successful exploitation allows extraction of sensitive database contents, including user credentials, administrative tokens, and SMTP configuration data, with a CVSS 4.0 score of 9.3 reflecting network-accessible impact on confidentiality, integrity, and availability.
The referenced GitHub commit, security advisory GHSA-289f-fq7w-6q2w, and VulnCheck advisory indicate that the issue is resolved by upgrading to phpMyFAQ 4.1.2 or later. The associated EPSS score remains flat at 0.0776 with no material increase observed after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30601
Vulnerability details
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform…
more
time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public /api/captcha endpoint directly enables exploitation of a public-facing web application (T1190) to extract database contents including credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of all input (including HTTP headers) before use in SQL statements, blocking the unsanitized User-Agent interpolation that enables the blind SQLi in BuiltinCaptcha methods.
Mandates timely application of patches or upgrades (here, to phpMyFAQ 4.1.2+) that eliminate the CWE-89 flaw in the public /api/captcha endpoint.
Requires continuous monitoring of system and application behavior to identify anomalous database queries or time-based delays originating from the unauthenticated captcha endpoint.