CVE-2025-10660: WP Dashboard Chat SQL Injection Vulnerability

CVE-2025-10660 Overview

CVE-2025-10660 is a SQL injection vulnerability in the WP Dashboard Chat plugin for WordPress. The flaw affects all versions up to and including 1.0.3. The plugin fails to escape the id parameter and does not properly prepare the SQL query that consumes it. Authenticated users with Contributor-level access or higher can append arbitrary SQL to the existing query. Successful exploitation enables extraction of sensitive data from the WordPress database, including user records and session artifacts.

Critical Impact
Authenticated Contributor-level users can execute arbitrary SQL queries against the WordPress database, exposing confidential data such as credentials and personally identifiable information.

Affected Products

WP Dashboard Chat plugin for WordPress
All plugin versions through 1.0.3
WordPress sites allowing Contributor-level registration or above

Discovery Timeline

2025-10-15 - CVE-2025-10660 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-10660

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in the WP Dashboard Chat plugin. The plugin accepts an id parameter from an authenticated request and concatenates it into a SQL query without escaping or using prepared statements. Because WordPress exposes the parameter path to users at the Contributor role or higher, the attack surface extends beyond administrators to any contributor account on the target site.

An attacker can append UNION SELECT statements or stacked subqueries to the existing query. This enables extraction of password hashes from wp_users, authentication tokens from wp_usermeta, and arbitrary data from any table reachable by the plugin's database user. The attack is network-reachable and requires no user interaction once the attacker has valid credentials.

Root Cause

The root cause is insufficient input sanitization combined with missing use of wpdb::prepare(). The plugin consumes the id parameter directly in a SQL statement rather than binding it as a typed parameter. The referenced plugin source at lines 99 and 207 of wp-dashboard-chat.php shows where the unsafe query construction occurs.

Attack Vector

Exploitation requires an authenticated session with Contributor privileges or higher. The attacker submits a crafted request containing SQL payload fragments in the id parameter. The plugin executes the resulting query against the WordPress database and returns or acts on data influenced by the injected SQL. See the Wordfence Vulnerability Report and the WP Dashboard Chat source line 207 for technical details.

Detection Methods for CVE-2025-10660

Indicators of Compromise

Web server access logs containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the id parameter of WP Dashboard Chat endpoints
Unexpected database errors referencing the plugin's query handlers in PHP error logs
Contributor-level accounts generating unusual volumes of AJAX or admin-ajax requests to the plugin
New or unrecognized Contributor accounts created shortly before suspicious plugin requests

Detection Strategies

Inspect HTTP request bodies and query strings for SQL metacharacters targeting the id parameter in requests to wp-admin/admin-ajax.php tied to WP Dashboard Chat actions
Correlate authenticated session identifiers with abnormal query response sizes or latency indicative of blind or union-based injection
Enable WordPress and MySQL general query logging on at-risk hosts during triage

Monitoring Recommendations

Alert on authenticated requests containing SQL syntax tokens to plugin endpoints
Monitor database user activity for queries touching wp_users or wp_usermeta from the plugin context
Track role escalation events and failed login attempts against Contributor and Author accounts

How to Mitigate CVE-2025-10660

Immediate Actions Required

Deactivate the WP Dashboard Chat plugin on all WordPress installations running version 1.0.3 or earlier until a patched release is confirmed
Audit Contributor, Author, Editor, and Administrator accounts and remove unknown or inactive users
Rotate WordPress administrator passwords and reset any API keys or tokens stored in the database
Restrict new user registration or require manual approval while the vulnerability remains unpatched

Patch Information

At the time of publication, no fixed version is referenced in the available NVD data for versions above 1.0.3. Monitor the Wordfence Vulnerability Report and the plugin's WordPress.org page for an official security release. Apply the patched version immediately once published.

Workarounds

Remove or disable the plugin until a security release is available
Deploy a web application firewall rule that blocks SQL metacharacters in the id parameter of plugin requests
Restrict plugin endpoint access to administrator roles via WordPress capability filters where feasible
Enforce least-privilege on the MySQL database user used by WordPress to limit information disclosure

bash

# Example: disable the plugin via WP-CLI
wp plugin deactivate wp-dashboard-chat
wp plugin delete wp-dashboard-chat