EUVD-2026-60938
GHSA-m8fg-jj39-vp5m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated remote SQLi gives AV:N/AC:L/PR:N/UI:N with high confidentiality (C:H) from database read; I:L for possible injection writes, A:N and S:N since no proven impact on a separate system.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.
AnalysisAI
SQL injection in the Sticky Chat Widget WordPress plugin (by gingerplugins) affects all versions up to and including 1.4.2, allowing remote unauthenticated attackers to inject arbitrary SQL and read sensitive database contents. Rated CVSS 9.3 with a scope-changed vector, it requires no authentication or user interaction, making it directly reachable on any site running the plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond the plugin being installed and active - remote unauthenticated exploitation against default configurations of any WordPress site running Sticky Chat Widget version 1.4.2 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuinely high-priority issue for anyone running the plugin: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation with no user interaction, and CWE-89 with C:H means full database read exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a target WordPress site running Sticky Chat Widget ≤1.4.2 and sends a single crafted HTTP request to the plugin's vulnerable endpoint with a malicious SQL payload in a chat/widget parameter. Because no authentication or user interaction is required (AV:N/PR:N/UI:N), the injected query executes against the WordPress database, letting the attacker extract administrator password hashes, session tokens, or secret keys. … |
| Remediation | No vendor-released patch version is identified in the available data - the advisory lists 1.4.2 and earlier as vulnerable without naming a fixed release, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sticky-chat-widget/vulnerability/wordpress-sticky-chat-widget-plugin-1-4-2-sql-injection-vulnerability) and the WordPress plugin repository for an update beyond 1.4.2 and upgrade as soon as one is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and disable the Sticky Chat Widget plugin on all WordPress instances (versions ≤1.4.2) using plugin scanning tools, or take affected sites offline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Sticky Chat Widget
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today