Click n Chat CVE-2026-92998

Exploitation requires that the vulnerable Click n Chat (Chat Widget Integration) plugin, version 1.0.4 up to but not including 1.1.3, be installed and active on a reachable WordPress site; the attacker must reach the request handler that passes a user-controlled sort parameter into the SQL ORDER BY clause. Per CVSS PR:N/UI:N, no authentication and no user interaction are required, so default installations are exploitable by remote unauthenticated attackers. The primary limiting factors are footprint-based rather than configuration-based: the site must run an affected version and the chat-widget functionality exposing the sortable query must be accessible. Impact is confidentiality-focused (database read) per the vector; no integrity or availability impact is claimed.

Multiple signals point to this being a genuine, actionable priority rather than an inflated high-CVSS issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction - the easiest possible exploitation profile - and the vulnerability class (CWE-89 SQL injection into an ORDER BY clause) is well-understood and reliably exploitable. Publicly available exploit code exists (via WPScan), which materially raises real-world likelihood, though POC availability is distinct from confirmed active exploitation. This CVE is NOT listed in CISA KEV and no EPSS score was provided in the input, so exploitation-probability and known-exploited signals cannot be corroborated - treat 'in-the-wild' claims as unproven. One notable discrepancy: the input CVSS sets Scope Changed (S:C) with only confidentiality impact (C:H/I:N/A:N), which is atypical for a classic ORDER BY SQLi that normally stays Scope Unchanged; this likely inflates the 8.6 base score, and my independent assessment (below) scores it lower. Net: a widely-reachable, POC-backed unauthenticated SQLi worth prioritizing wherever this plugin is installed, but the 8.6 figure should be read with the scope caveat in mind.

An unauthenticated attacker identifies a WordPress site running Click n Chat before 1.1.3 and sends a crafted HTTP request manipulating the sort parameter that feeds the SQL ORDER BY clause. Because the parameter is unsanitised, the attacker injects SQL (e.g. via boolean/time-based blind techniques common to ORDER BY contexts) to extract database contents such as user credentials and secrets. Public exploit code referenced by WPScan lowers the skill barrier for carrying this out.