Chaty Pro <= 3.5.5 Authenticated SQL Injection via 'widget_id' Parameter (CVE-2026-6251)

Vulnerability Overview Vulnerability Name: Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter CVE ID: CVE-2026-6251 CVSS Score: 6.5 (Medium) Release Date: July 27, 2026 Last Updated: July 28, 2026 Researcher: h0v1s Affected Versions Affected Versions: <= 3.5.5 Fixed Version: 3.5.6 Remediation Remediation Advice: Update to version 3.5.6 or later patched versions. Vulnerability Description The Chaty Pro plugin for WordPress contains a post-authentication time-based blind SQL injection vulnerability affecting versions 3.5.5 and below. This vulnerability arises because the function in retrieves the POST parameter via and directly concatenates its value into a raw SQL query without using or any integer casting. Furthermore, a non-CE validation check is executed only after the SQL query has already been executed, creating an opportunity for authenticated attackers with subscriber-level access to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents, including user credentials and configuration data. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Options Facebook X (Twitter) LinkedIn Email Additional Information Software Type: Plugin Software Slug: chaty-pro Patched: Yes Previous Vulnerability: Chaty Pro <= 3.3.3 - Unauthenticated Arbitrary File Upload (CVE-2025-26776, CVSS 9.8, Researcher: luc, Date: February 14, 2025) Disclaimer This record contains copyrighted material. Copyright: 2012-2026 Defiant Inc. MITRE Corporation Copyright: 1999-2025 Contact For adding information or reporting errors, please contact: wfi-support@wordfence.com Business Hours 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) 24-hour support for customers received, 365 days a year, with a 1-hour response time Terms of Service Terms of Service Privacy Policy and Collection Notice Do Not Sell or Share My Personal Information Products and Support Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central News and Updates Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Subscribe to news and updates from our team of experienced security professionals Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Disclaimer Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Instagram Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Other Links Terms of Service Privacy Policy Collection Notice Do Not Sell or Share My Personal Information Additional Information Term

Goal Reached Thanks to every supporter — we hit 100%!

Chaty Pro <= 3.5.5 Authenticated SQL Injection via 'widget_id' Parameter (CVE-2026-6251)