Authenticated Time-Based Blind SQL Injection in Chaty Pro Plugin for WordPress

CVE-2026-6251

What is CVE-2026-6251?

The Chaty Pro plugin for WordPress contains a serious vulnerability where the fetch_custom_field() function retrieves the widget_id POST parameter unsafely. This parameter is concatenated into a raw SQL query without proper sanitization or integer casting, significantly heightening the risk of SQL injection attacks. Additionally, the nonce verification check is executed post-query, failing to provide necessary protection against potential SQL injection. Authenticated users with at least subscriber-level access can exploit this flaw to craft and execute arbitrary SQL commands, which may lead to unauthorized access to confidential database contents, such as user credentials and configuration settings.

References