CVE-2026-4815

Support Board is a live-chat plugin many small-business websites use to talk to customers. This bug lets an attacker who already has a basic account trick the chat system into running their own database commands — like handing a stranger a master key to your customer records filing cabinet. Hackers have already used this exact trick to steal hundreds of thousands of records from other organizations.

This matters to you if your website runs the Support Board plugin, specifically any version up to and including 3.7.7. An attacker needs only a low-level account on your site (such as a basic chat/agent login) to exploit it — no tricking of users or admin access is required.

This is urgent: attackers are already exploiting this vulnerability in real attacks, with one group confirmed to have stolen over 628,000 records from four organizations. This is not a theoretical risk — act now rather than waiting for a routine update cycle.

Confirm exposure by identifying the installed Support Board version on all WordPress (or standalone) sites using the plugin; the flaw lives in the 'calls[0][message_ids][]' parameter handled by /supportboard/include/ajax.php, exploitable by any account holding low-level privileges (PR:L) with no user interaction required. Upgrade to version 3.7.8 or later, released by the Schiocco team in February 2025 — this is the only confirmed fixed version; no partial mitigation or WAF rule is documented as reliable, so patching is the primary remediation. There is no CISA KEV deadline since this CVE is not yet listed in KEV, but given confirmed active exploitation (CyberXero campaign, AI-augmented initial access against WordPress sites and critical infrastructure), treat it with KEV-equivalent urgency. As a temporary mitigation if upgrade is delayed, restrict or disable low-privilege account creation/access to the support chat feature and monitor web server/database logs for anomalous queries referencing message_ids or ajax.php. After patching, audit the database for unauthorized modifications and review any exfiltrated-data indicators consistent with the reported incidents.

CVSS 3.1 score 8.8 (High), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-exploitable SQL injection (CWE-89) requiring only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability. Not currently listed in CISA KEV, but confirmed active exploitation is reported in the press (CyberXero actor, four Ukrainian organizations, 628,000+ records exfiltrated) as part of a broader AI-augmented initial-access campaign against WordPress sites. No public exploit code (PoC) is on record, but real-world weaponization already exists. EPSS predicted exploitation likelihood is low (14th percentile) and should be disregarded given confirmed in-the-wild exploitation, which supersedes the prediction. Fixed in version 3.7.8 (February 2025).