CVE-2026-56738 phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
An authenticated administrator can inject arbitrary SQL via the stop word management feature in phpMyFAQ, allowing data exfiltration or modification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56738?
CVE-2026-56738 is a high-severity SQL injection vulnerability in thorsten phpMyFAQ, published on 24 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, `StopWords::update()`, which modifies an existing stop word, correctly escapes the same kind of input. The omission is isolated to the `add()` (insert) code path. An authenticated administrator who can reach the stop-word management feature can submit a crafted value as the "word" parameter that breaks out of the SQL string literal and injects arbitrary SQL, including statements to drop tables, exfiltrate data, or modify other rows in the database. Version 4.1.6 fixes the issue.
Weakness: CWE-89
Which versions are affected by CVE-2026-56738?
4 open source packages ship an affected version, including thorsten/phpmyfaq and phpmyfaq/phpmyfaq.
| Package | Affected | Fixed in |
|---|---|---|
thorsten/phpmyfaq Packagist | All versions | 4.1.6 |
thorsten/phpmyfaq Packagist | All versions | 4.1.6 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.6 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.6 |
How do I fix CVE-2026-56738?
Upgrade thorsten/phpmyfaq to 4.1.6 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-56738 being exploited?
There is no known exploitation of CVE-2026-56738 in the wild and no public exploit code.
Sources
Also known as GHSA-rw77-vq4g-x3hp.