The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress allows unauthenticated users to trigger an AJAX endpoint that uses the 'fildname' parameter without proper escaping or preparation, enabling a time‑based blind SQL injection. An attacker can embed SQL fragments in the parameter value, causing the database to execute the injected code. Because the endpoint is registered with wp_ajax_nopriv_, no authentication is required, so the attacker can extract sensitive information such as administrator password hashes or other data, resulting in complete data compromise. This is a classic SQL Injection vulnerability (CWE‑89).

The vulnerability impacts all installations of WP CTA – Call Now Button, Sticky Button & Call to Action Builder version 2.2.2 and earlier, a WordPress plugin developed by blendmedia. Any WordPress site that has a vulnerable copy of this plugin is at risk, regardless of site size or role, because the exposed AJAX endpoint is publicly reachable.

The CVSS score of 7.5 reflects a high severity that indicates substantial impact on confidentiality. The EPSS score of less than 1% suggests that exploit attempts are currently rare, and the vulnerability is not tracked in the CISA KEV catalog. The likely attack vector is remote, with attackers sending crafted requests to the wp_ajax_nopriv_ endpoint from anywhere on the Internet. If successful, the time‑based blind SQL injection can be used to leak database contents and compromise site integrity.