CVE-2026-15462: Sticky Chat Widget WordPress SQLi Flaw

CVE-2026-15462 Overview

The Sticky Chat Widget plugin for WordPress contains an unauthenticated SQL injection vulnerability affecting all versions up to and including 1.4.2. The flaw resides in the scw_save_form_data AJAX action, where attacker-controlled POST array keys from the scw_form_fields parameter are passed unsanitized into $wpdb->insert(). Because WordPress wraps column identifiers in backticks without escaping them, an attacker-supplied backtick breaks out of the column-identifier context into raw SQL. Unauthenticated remote attackers can append arbitrary SQL to the query and extract sensitive database contents.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database and exfiltrate sensitive information, including user credentials and session tokens.

Affected Products

Sticky Chat Widget plugin for WordPress, versions ≤ 1.4.2
WordPress sites with the plugin installed and activated
Any site exposing the scw_save_form_data AJAX endpoint

Discovery Timeline

2026-09-11 - CVE-2026-15462 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-15462

Vulnerability Analysis

The vulnerability [CWE-89] exists in the save_form_data() function within includes/front-end.php of the Sticky Chat Widget plugin. The function accepts the scw_form_fields POST parameter and iterates its keys as database column names. These keys are handed directly to $wpdb->insert(), which encloses each identifier in backticks but performs no escaping. An attacker can supply a key containing a backtick character to terminate the identifier context and inject raw SQL into the compiled statement.

Two additional defects amplify the flaw. First, the plugin uses filter_input() to read POST data, which bypasses WordPress's wp_magic_quotes() protection that would normally slash-escape input. Second, the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving the internal $isValid flag at 1 and permitting the vulnerable code path to execute.

Root Cause

The root cause is trust in attacker-controlled array keys as safe SQL identifiers. WordPress's $wpdb->insert() sanitizes values but treats column-name keys as trusted input. Combined with the filter_input() bypass of magic-quote handling and a broken validation gate, unauthenticated input flows directly into query construction.

Attack Vector

An unauthenticated remote attacker sends a crafted POST request to the WordPress admin-ajax.php endpoint invoking the scw_save_form_data action. The request includes a scw_form_fields array with a key containing a backtick followed by injected SQL syntax. The malicious SQL executes in the context of the WordPress database user, enabling extraction of table contents via UNION-based or time-based blind techniques.

See the Wordfence Vulnerability Analysis and the WordPress plugin source at line 141 for the vulnerable code path.

Detection Methods for CVE-2026-15462

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=scw_save_form_data from unauthenticated sources
Request bodies where scw_form_fields[] array keys contain backtick characters, SQL keywords such as UNION, SELECT, SLEEP, or comment markers (--, #)
Unusual database query latency or errors in wp-content/debug.log correlated with the AJAX endpoint
Outbound data flows or new rows in the plugin's form-data table following suspicious requests

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php with scw_save_form_data and non-alphanumeric characters in nested array parameter names
Deploy web application firewall (WAF) rules matching backtick or SQL metacharacters in scw_form_fields key positions
Enable MySQL general query logging temporarily on high-risk sites and alert on queries referencing the plugin's table with malformed column identifiers

Monitoring Recommendations

Alert on any successful HTTP 200 response to unauthenticated scw_save_form_data requests originating from a single IP at high frequency
Monitor for anomalous SELECT patterns against wp_users, wp_usermeta, and wp_options tables outside normal application flows
Track WordPress plugin inventory to identify sites still running Sticky Chat Widget ≤ 1.4.2

How to Mitigate CVE-2026-15462

Immediate Actions Required

Update the Sticky Chat Widget plugin to the patched release beyond version 1.4.2 as reflected in WordPress Changeset #3640407
If no patched release is available on your site, deactivate and remove the plugin immediately
Review database audit logs for evidence of data exfiltration during the exposure window
Rotate WordPress administrator credentials and API keys stored in the database

Patch Information

The upstream fix is committed in WordPress plugin repository changeset 3640407, which modifies includes/front-end.php to sanitize array keys before they reach $wpdb->insert() and to correctly enforce the widget_id validation gate. Site operators must upgrade to any release incorporating this changeset.

Workarounds

Block unauthenticated POST requests to admin-ajax.php with action=scw_save_form_data at the WAF or reverse proxy until the plugin is updated
Restrict access to the WordPress admin AJAX endpoint by IP allowlist where feasible
Disable the Sticky Chat Widget plugin entirely on sites that do not require its functionality

bash

# Example ModSecurity rule to block backtick injection in scw_form_fields keys
SecRule ARGS_NAMES "@rx scw_form_fields\[[^\]]*`" \
  "id:1015462,phase:2,deny,status:403,\
  msg:'CVE-2026-15462 Sticky Chat Widget SQLi attempt'"