phpMyFAQ: Authenticated SQL Injection in Stop Word Management (CVE-2026-56738)

What happened

A SQL injection vulnerability was identified in phpMyFAQ's `StopWords::add()` method. This method builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string without applying the application's database escaping function. A sibling method, `StopWords::update()`, which modifies an existing stop word, correctly escapes the same type of input, meaning the flaw is isolated to the add/insert code path.

Technical cause

The root cause is improper neutralization of special elements in an SQL command (CWE-89). Because the `add()` method does not escape the "word" parameter before inserting it into the SQL string, a crafted value can break out of the intended SQL string literal, allowing an attacker to append arbitrary SQL statements to the query.

Why it matters

An attacker who can inject arbitrary SQL through this path could drop database tables, exfiltrate data, or modify other rows in the database, potentially compromising the confidentiality and integrity of the entire phpMyFAQ installation's database.

Who is affected

Exploitation requires an authenticated administrator account with access to the stop-word management feature in phpMyFAQ. This is not an unauthenticated, remotely exploitable vulnerability; the attacker (or compromised admin account) must already have administrative privileges within the application.

Affected versions

The vulnerability affects the `phpmyfaq/phpmyfaq` and `thorsten/phpmyfaq` Composer packages in versions up to and including 4.1.5. Version 4.1.6 contains the fix.

Fixes and mitigation

The vendor has released version 4.1.6, which corrects the missing escaping in the `StopWords::add()` method. Site owners running affected versions should upgrade to 4.1.6.

Recommended action

Update phpMyFAQ to version 4.1.6 as soon as possible. In the interim, limit administrative access to trusted users only, since exploitation requires an authenticated administrative account with access to the stop-word management feature.