CVE-2026-6251

Name of the Vulnerable Software and Affected Versions Chaty Pro versions prior to 3.5.6

Description Authenticated users with subscriber-level access and above can perform a Time-Based Blind SQL Injection. This occurs because the fetch custom field() function in admin/class-admin-base.php retrieves the widget id POST parameter and concatenates it directly into a raw SQL query without using $wpdb->prepare() or integer casting. Furthermore, the nonce verification check is executed after the SQL query, failing to prevent the injection. This flaw allows attackers to execute arbitrary SQL commands to extract sensitive database information, such as configuration data and user credentials.

Recommendations Update Chaty Pro to a version newer than 3.5.5. As a temporary mitigation, restrict access to the administrative functions that utilize the fetch custom field() function.