The My Sticky Bar WordPress plugin allows unauthenticated users to perform a blind time‑based SQL injection via the stickymenu_contact_lead_form AJAX action. Attackers craft POST parameter names that are used directly as column identifiers in a SQL INSERT statement, bypassing parameter sanitization. Because the attacker‑controlled keys become part of the SQL, they can manipulate the query to exfiltrate data or potentially modify the database. This vulnerability provides a high‑impact data exposure vector rooted in CWE‑89.

The vulnerability affects the Premio My Sticky Bar plugin (formerly myStickymenu) in all releases up to and including version 2.8.6. Any WordPress installation utilizing these plugin versions is potentially exposed, regardless of user privileges, because the vulnerable AJAX endpoint can be accessed without authentication.

The CVSS score is 7.5, indicating a high severity, while the EPSS score is below 1 % and the flaw is not listed in CISA’s KEV catalog, suggesting current exploitation risk is low but not negligible. Exploitation requires the target to be running the vulnerable plugin with the stickymenu_contact_lead_form action enabled, and the attacker must send a crafted HTTP POST request. Although the attack vector is remote and unauthenticated, the potential impact of data exposure or unauthorized database manipulation makes this a high‑risk issue.