Click n Chat CVE-2026-92997

No special conditions beyond having the vulnerable plugin installed - per the description and the PR:N/UI:N vector, exploitation is remote and unauthenticated against default configurations of Click n Chat (Chat Widget Integration) before 1.1.3. The specific prerequisite is reaching the code path that passes an attacker-controlled parameter into a SQL query as a column identifier without validation; because the untrusted value is used as an identifier (not a bound value), standard parameterization does not neutralize it. The primary limiting factor is reach/footprint: only WordPress sites that have this specific plugin installed and at a version below 1.1.3 are affected, which is a narrow population.

Multiple signals align toward genuine priority for sites running this plugin. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, and CWE-89 SQL injection is consistent with the description. Publicly available exploit code exists (reported by WPScan), which raises near-term exploitation likelihood for exposed instances. No CISA KEV listing and no EPSS score were provided, so there is no evidence of confirmed active exploitation or a quantified exploitation probability - treat exploitation as plausible-but-unproven rather than observed. The input vector claims scope change (S:C) and confidentiality-only impact (C:H/I:N/A:N); a column-identifier injection is often read-oriented, but SQLi frequently also enables data tampering, so the I:N/A:N claim may understate real impact - verify against the WPScan advisory. The dominant risk limiter is not the vulnerability itself but the deployment footprint: this is an obscure WordPress plugin, so aggregate internet-wide exposure is likely small even though any individual affected site is at high risk.

A remote, unauthenticated attacker identifies a WordPress site running Click n Chat before 1.1.3 and sends a crafted request supplying a malicious value for the parameter that the plugin uses unsanitized as a SQL column identifier. Because the injection point is a column name, the attacker manipulates the query structure to extract database contents such as user records or secrets. Public exploit code exists, lowering the skill needed to reproduce the attack.