CVE-2026-6251— WordPress Chaty Pro SQL注入漏洞

Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() function in admin/class-admin-base.php retrieving the widget_id POST parameter via filter_input(INPUT_POST, ...) and directly concatenating the value into a raw SQL query in a numeric context without using $wpdb->prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

WordPress Chaty Pro SQL注入漏洞

WordPress Chaty Pro是WordPress基金会的一款客服聊天插件。 WordPress Chaty Pro 3.5.5及之前版本存在SQL注入漏洞，该漏洞源于fetch_custom_field()函数中直接拼接widget_id POST参数到SQL查询，导致容易受到基于时间的盲SQL注入攻击，可能使经过身份验证的攻击者提取数据库敏感内容。

N/A

N/A