What the vulnerability does
01Description
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() function in admin/class-admin-base.php retrieving the widget_id POST parameter via filter_input(INPUT_POST, ...) and directly concatenating the value into a raw SQL query in a numeric context without using $wpdb->prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data.
Explanation of Vulnerability in Simple Terms
02Summary
Chaty Pro versions 3.5.5 and earlier contain a SQL injection vulnerability in a database query that processes user input without proper sanitization. An authenticated attacker can craft malicious input to read sensitive data from the site's database, including user credentials and private information. The vulnerability requires a valid user account but no additional user interaction.
What an attacker can do
03Attacker Capabilities
Read sensitive data from the site database, including user credentials and private information.
Potential impact on your site
04Site Impact
User data and credentials stored in the database may be exposed to authenticated attackers.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account on the site; no user interaction required.
Key dates
06Disclosure timeline
July 28, 2026
CVE published
July 28, 2026
Record updated
