EUVD-2026-49690
GHSA-h976-4r88-23hx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber credentials
-
DeliverySend crafted POST to admin endpoint
-
ExploitSQL injection in fetch_custom_field()
-
ExecutionBlind time-based extraction
-
ImpactExfiltrate user credentials and config data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have a valid WordPress user session with at least the Subscriber role. The vulnerable fetch_custom_field() function is triggered via an AJAX or admin POST request that includes the widget_id parameter; no additional plugin configuration is required. The nonce check occurs after the SQL query, so it does not prevent exploitation. The attack is limited to the network accessibility of the WordPress instance and the existence of subscriber accounts-common in many deployments. |
| Impact | The CVSS 3.1 base score is 6.5 (medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates a network-accessible, low-complexity attack requiring only subscriber-level authentication and no user interaction, leading to high confidentiality impact. No data on EPSS probability or CISA KEV status was provided; however, the lack of public exploit reports suggests limited active exploitation. The real-world risk is moderate: while authentication lowers the barrier compared to unauthenticated SQL injection, subscriber accounts are common and often poorly secured. The blind nature of the injection (time-based) may slow exploitation but does not reduce impact. Missing signals: EPSS and KEV data are unavailable; patch availability is inferred but not confirmed from the provided references. |
| Exploit ScenarioDerived | An authenticated attacker with a subscriber-level account submits a crafted POST request to the vulnerable Admin AJAX endpoint, injecting a time-based SQL payload into the widget_id parameter. The blind injection allows the attacker to enumerate sensitive data, such as user password hashes or WordPress configuration secrets, bit by bit over successive requests. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
SQL injection in the Chaty Pro WordPress plugin (up to version 3.5.5) allows authenticated attackers with subscriber-level access to extract sensitive database contents, including user credentials and configuration data. The vulnerability exists in the fetch_custom_field() function, which directly concatenates the widget_id POST parameter into a raw SQL query without using $wpdb->prepare(). No public exploit or active exploitation has been identified at the time of analysis, and the risk is elevated by the low privilege requirement.
RemediationAI
The primary remediation is to upgrade Chaty Pro to the latest version that includes a fix for this SQL injection. While the provided references do not specify a patched version, the vendor (Premio) typically releases updates; check the plugin changelog at https://plugins.trac.wordpress.org/browser/chaty-pro/ or the Wordfence advisory for the fixed version number. As a workaround, restrict subscriber-level privileges by ensuring only trusted users have accounts, or deploy a web application firewall (WAF) rule that blocks suspicious SQL patterns in the widget_id POST parameter. Note that blocking widget_id entirely may break legitimate chat functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Chaty Pro is a premium WordPress plugin that provides live chat and customer communication features, written in PHP. The vulnerability is a classic SQL injection (CWE-89) arising from the fetch_custom_field() function in admin/class-admin-base.php. The function retrieves the widget_id parameter using filter_input(INPUT_POST, ...) and concatenates it directly into a SQL query within a numeric context, bypassing WordPress's built-in parameterized query methods ($wpdb->prepare()) and type casting. The nonce verification is performed after the query executes, rendering it ineffective. The affected CPE string cpe:2.3:a:chaty:chaty_pro:*:*:*:*:*:*:*:* indicates any version of Chaty Pro is potentially vulnerable.
Know when Chaty gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Requires subscriber-level authentication (PR:L); no user interaction; confidentiality impact only.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() function in admin/class-admin-base.php retrieving the widget_id POST parameter via filter_input(INPUT_POST, ...) and directly concatenating the value into a raw SQL query in a numeric context without using $wpdb->prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin befo
The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could al
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty chaty
Exploit-DB