CVE-2026-6251

Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() function in admin/class-admin-base.php retrieving the widget_id POST parameter via filter_input(INPUT_POST, ...) and directly concatenating the value into a raw SQL query in a numeric context without using $wpdb->prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data.

We have discovered 4,020 live websites that are affected by CVE-2026-6251.

Run a Free Instant Scan



Affected Software

Product  Chaty Pro
Category Wordpress Plugins
Vulnerable Domains4,020 live websites (100% of Chaty Pro install base)
Vulnerable Versions
  • from 0 through 3.5.5
Vulnerable Versions Count48 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')



Details

  • Published - Jul 28, 2026
  • Updated - Jul 28, 2026

Credits

  • h0xilo (finder)

Website Distribution by Country

Number of websites using CVE-2026-6251
United States885 websites


Russia318 websites
Germany262 websites
Iran223 websites
GB171 websites
Cyprus152 websites
India152 websites
Thailand150 websites
Brazil115 websites
Turkey107 websites

Website Distribution by TLD

Number of websites using CVE-2026-6251
.com1,931 websites
.ru237 websites
.com.br113 websites
.co.uk93 websites
.net88 websites
.de66 websites
.it66 websites
.org61 websites
.com.au50 websites
.es39 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-6251

Top websites that are affected by CVE-2026-6251. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**************.com GB**,***
************.org United States**,***
********.es Spain**,***
********************.org United States***,***
************.com United States***,***
***********.com United States***,***
***********.com Thailand***,***
*****.nu Germany***,***
***************.it United States***,***
************.com United States***,***
See full domain list

FAQ

CVE-2026-6251 is Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Chaty Pro
A total of 4,020 websites have been identified as vulnerable to CVE-2026-6251, based on global website indexing conducted by WebTechSurvey.
The Chaty Pro is affected by the CVE-2026-6251 vulnerability.
Chaty Pro versions up to and including 3.5.5 are vulnerable to CVE-2026-6251.