Junglewise Threat Intelligence

CVE-2026-6251: Chaty Chaty Pro SQL injection in fetch_custom_field

CVE-2026-6251 · Severity: medium · CVSS 6.5 · Published 2026-07-28

Executive brief

Chaty Pro, a WordPress plugin used to add chat and communication widgets to websites, contains a security flaw that could allow logged-in users to access sensitive information. By sending specially crafted requests, an attacker with even low-level account access could extract data from the website's database. This could include sensitive details like user credentials and site configuration settings, potentially compromising the entire site.

Technical details

The Chaty Pro plugin for WordPress is vulnerable to a time-based blind SQL injection due to improper input sanitization in the fetch_custom_field() function within admin/class-admin-base.php. The 'widget_id' POST parameter is retrieved and concatenated directly into a raw SQL query without using parameterized queries ($wpdb->prepare) or integer casting. Furthermore, the security nonce verification occurs after the query has already been executed, rendering the check ineffective. An authenticated attacker with subscriber-level permissions or higher can exploit this to execute arbitrary SQL commands and exfiltrate sensitive data from the database.

Affected products

  • Chaty Chaty Pro up to and including 3.5.5

Timeline

  • 2026-07-28: advisory: NVD publication date

References