Executive brief
The Sticky Chat Widget WordPress plugin, used to add live chat functionality to websites, contains a SQL injection vulnerability in its form data handling. An unauthenticated attacker can inject malicious SQL commands through form field parameters, potentially extracting sensitive database information such as customer data, credentials, or business intelligence.
Technical details
The vulnerability is a SQL injection flaw in the save_form_data() AJAX action handler of the Sticky Chat Widget plugin. The vulnerable code passes unsanitized POST array keys directly to $wpdb->insert() as column identifiers; while the function wraps identifiers in backticks, it does not escape them, allowing an attacker to inject a backtick character to break out of the column identifier context into raw SQL. Additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and widget validation is skipped when an invalid widget_id is supplied. The attack is unauthenticated and network-accessible via the AJAX endpoint. Successful exploitation allows extraction of arbitrary data from the WordPress database.
Affected products
- WordPress Sticky Chat Widget up to 1.4.2
Timeline
- 2026-09-11: disclosed