CVE-2026-56738: phpMyFAQ SQL Injection Vulnerability in StopWords::add() Method
Summary
CVE-2026-56738: phpMyFAQ has SQL Injection in StopWords::add() — Unescaped Stop Word Insertion. Affects phpmyfaq/phpmyfaq versions < 4.1.6. Fixed in 4.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyFAQ is an open-source FAQ management system that allows users to create and manage FAQs efficiently. It provides features such as multilingual support, user management, and a customizable interface. However, a vulnerability exists in the StopWords management feature, specifically in the method responsible for adding new stop words, which can lead to SQL injection attacks.
Vulnerability Detail
The vulnerability arises from the StopWords::add() method, which constructs an SQL INSERT statement using user-supplied input without proper escaping. This oversight allows an authenticated administrator to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or even deletion of database tables. The vulnerability is particularly concerning as it can be exploited by an attacker with valid administrator credentials, allowing them to execute harmful SQL statements that compromise the integrity and availability of the database.
How To Fix
Minimum fixed version
4.1.6
This is the first release that contains the fix.
composer require phpmyfaq/phpmyfaq:4.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that only trusted administrators have access to the Stop Words management feature until the package is updated. Additionally, consider implementing input validation to sanitize user inputs before processing them.
Conclusion
The SQL injection vulnerability in phpMyFAQ's StopWords::add() method poses a significant risk to applications using this software. By updating to the patched version and implementing best practices for input validation, administrators can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for phpmyfaq/phpmyfaq →
FAQ
CVE-2026-56738 is a vulnerability in phpMyFAQ that allows SQL injection through the StopWords::add() method due to improper input handling.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
The vulnerability can lead to unauthorized data access, data modification, or even complete database deletion, compromising the integrity and availability of the application.
An attacker with valid administrator credentials can exploit this vulnerability, making it crucial to secure administrator accounts.
Update phpMyFAQ to version 4.1.6 or later to fix the vulnerability. Additionally, restrict access to the Stop Words management feature and validate user inputs.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyfaq/phpmyfaq.
