CVE-2026-6251: 
WordPress vulnerability analysis and mitigation

CVE-2026-6251 is an Authenticated Time-Based Blind SQL Injection vulnerability in the Chaty Pro plugin for WordPress, affecting versions up to and including 3.5.5. The flaw resides in the fetch_custom_field() function within admin/class-admin-base.php, where the widget_id POST parameter is directly concatenated into a raw SQL query without sanitization. It was published on July 28, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The fetch_custom_field() function in admin/class-admin-base.php retrieves the widget_id POST parameter via filter_input(INPUT_POST, ...) and directly concatenates it into a raw SQL query in a numeric context, bypassing WordPress's $wpdb->prepare() mechanism and without applying integer casting. Critically, the nonce verification check is performed after the SQL query has already executed, rendering it ineffective as a security control. This allows any authenticated user with subscriber-level access or higher to submit a crafted POST request and perform time-based blind SQL injection (GitHub Advisory, Wordfence).

Successful exploitation allows authenticated attackers with minimal privileges (subscriber-level or above) to extract sensitive data from the WordPress database, including user credentials (hashed passwords), email addresses, configuration data, and other stored content. The impact is limited to confidentiality — integrity and availability are not directly affected by this vulnerability. However, extracted credentials could enable privilege escalation or account takeover, potentially leading to full site compromise (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Chaty Pro plugin version 3.5.5 or earlier using tools like WPScan or by checking the plugin's readme.txt file at wp-content/plugins/chaty-pro/readme.txt.
2. Obtain authenticated access: Register or obtain a subscriber-level (or higher) account on the target WordPress site.
3. Identify the vulnerable endpoint: Locate the AJAX action or admin endpoint that invokes the fetch_custom_field() function in admin/class-admin-base.php.
4. Craft the malicious payload: Construct a POST request targeting the vulnerable endpoint with a time-based blind SQL injection payload in the widget_id parameter (e.g., widget_id=1 AND SLEEP(5)--) to confirm injection.
5. Extract data: Use automated tools such as sqlmap with session cookies to enumerate the database, extract the wp_users table (usernames, hashed passwords, emails), and retrieve other sensitive configuration data.
6. Post-exploitation: Crack extracted password hashes offline or use extracted admin credentials to gain elevated access to the WordPress dashboard (GitHub Advisory, Wordfence).

• Network: Unusual POST requests to WordPress admin AJAX endpoints (e.g., wp-admin/admin-ajax.php) with widget_id parameter values containing SQL syntax such as SLEEP(), BENCHMARK(), AND 1=1, or -- comment sequences.
• Logs: WordPress or web server access logs showing repeated requests to the Chaty Pro admin endpoint with abnormal widget_id values; requests exhibiting consistent time delays (e.g., 5-second response intervals) indicative of time-based blind injection.
• Database: Unexpected or high-volume database query activity originating from the WordPress application user, particularly queries involving SLEEP() or conditional time-delay functions in the context of Chaty Pro tables.
• Process: Elevated database CPU usage or query execution times inconsistent with normal plugin activity.

Update the Chaty Pro plugin to a version newer than 3.5.5, which addresses this vulnerability by implementing proper parameterized queries. As interim mitigations, site administrators should use $wpdb->prepare() for all database operations, enforce integer casting on numeric parameters, and ensure nonce verification occurs before any database queries execute. Restricting user registration or limiting subscriber-level access on sites where it is not required will also reduce the attack surface (GitHub Advisory, Wordfence).

The vulnerability was assigned and disclosed by Wordfence, a leading WordPress security firm, and published to the GitHub Advisory Database on July 28, 2026. No significant broader media coverage or notable researcher commentary beyond the initial advisory has been observed at this time (Wordfence, GitHub Advisory).