CVE-2026-6251: Chaty Pro WordPress Plugin SQLi Vulnerability

CVE-2026-6251 Overview

CVE-2026-6251 is an authenticated time-based blind SQL Injection vulnerability [CWE-89] in the Chaty Pro plugin for WordPress, affecting all versions up to and including 3.5.5. The fetch_custom_field() function in admin/class-admin-base.php retrieves the widget_id POST parameter and concatenates it directly into a raw SQL query without using $wpdb->prepare() or integer casting. Nonce verification occurs after the SQL query executes, providing no protection against injection. Authenticated attackers holding subscriber-level access or higher can inject arbitrary SQL and extract sensitive database contents, including user credentials and configuration data.

Critical Impact

Authenticated subscribers can extract WordPress user credentials, session tokens, and configuration data through blind SQL injection against the Chaty Pro plugin.

Affected Products

• Chaty Pro plugin for WordPress, versions up to and including 3.5.5
• WordPress installations using vulnerable admin/class-admin-base.php code paths
• Sites permitting subscriber-level (or higher) user registration with Chaty Pro enabled

Discovery Timeline

• 2026-07-28 - CVE-2026-6251 published to NVD
• 2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-6251

Vulnerability Analysis

The vulnerability resides in the fetch_custom_field() function inside admin/class-admin-base.php of the Chaty Pro plugin. The function reads the widget_id value using filter_input(INPUT_POST, ...) and inserts it into a SQL statement in a numeric context. No parameterization occurs through $wpdb->prepare(), and the value is not cast to an integer, so attacker-controlled SQL fragments reach the database engine. The nonce check that would otherwise gate the request is executed after the query runs, so CSRF-style protection provides no defense here.

Because the injection point is numeric and the response does not reflect query output, exploitation relies on time-based blind techniques using functions such as SLEEP() or BENCHMARK() to infer data one bit at a time.

Root Cause

The root cause is unsafe string concatenation of untrusted POST input into a raw SQL query, combined with out-of-order authorization logic. WordPress developer guidelines require all user-controlled values to pass through $wpdb->prepare() or explicit type casting before being placed into SQL. The plugin violates both requirements and additionally sequences the nonce validation after the vulnerable query.

Attack Vector

An attacker registers or authenticates as a WordPress user with subscriber privileges. The attacker then issues a crafted POST request to the plugin's admin action endpoint with a widget_id payload containing a time-delay SQL primitive. Observing the server response time discloses one bit of database content per request. Repeating the process enumerates tables such as wp_users, extracting user_login and user_pass hashes for offline cracking or authenticated pivots.

See the Wordfence Vulnerability Report and the WordPress Chaty Pro source at line 3623 for the vulnerable code path.

Detection Methods for CVE-2026-6251

Indicators of Compromise

• POST requests to Chaty Pro admin endpoints containing widget_id values with non-numeric characters such as SLEEP, BENCHMARK, AND, OR, or SQL comment markers -- and #.
• Web server access logs showing repeated requests from a single authenticated subscriber account with response times clustering around multiples of a delay value.
• Sudden spikes in wp-admin/admin-ajax.php or admin-post.php traffic from low-privilege accounts.

Detection Strategies

• Enable MySQL general query logging or slow query logging and search for queries referencing the Chaty Pro custom field table with time-delay functions.
• Deploy a Web Application Firewall rule that inspects widget_id POST parameters and blocks non-integer content.
• Correlate authenticated subscriber sessions against outbound query duration anomalies in application performance monitoring data.

Monitoring Recommendations

• Alert on WordPress requests where an authenticated subscriber triggers admin-ajax handlers registered by Chaty Pro.
• Track failed and successful login events for newly registered subscriber accounts within 24 hours of Chaty Pro admin action activity.
• Monitor for outbound exfiltration patterns following long-duration database responses to identify credential harvesting.

How to Mitigate CVE-2026-6251

Immediate Actions Required

• Upgrade the Chaty Pro plugin to a version later than 3.5.5 once the vendor publishes a fix.
• Disable the Chaty Pro plugin on any WordPress site that permits subscriber-level registration until patched.
• Disable open user registration (Settings > General > Membership) where Chaty Pro must remain active.
• Rotate WordPress user passwords and secret keys in wp-config.php if exploitation is suspected.

Patch Information

A fixed version addressing the SQL injection in fetch_custom_field() should replace unsafe concatenation with $wpdb->prepare() and enforce integer casting on widget_id. Refer to the Wordfence advisory for the latest fixed release information and to the Chaty Pro plugin source for the affected code location.

Workarounds

• Apply a WAF virtual patch that rejects requests to Chaty Pro admin endpoints when widget_id is not strictly numeric.
• Restrict access to wp-admin/admin-ajax.php and Chaty Pro admin actions by IP allowlist for administrative users.
• Remove subscriber and equivalent low-privilege accounts that are not required for site operation.

# Example ModSecurity rule blocking non-numeric widget_id values
SecRule ARGS:widget_id "!@rx ^[0-9]+$" \
  "id:1026625,phase:2,deny,status:400,\
  msg:'CVE-2026-6251 Chaty Pro widget_id SQLi attempt',\
  tag:'attack-sqli',tag:'wordpress'"