{"id":"CVE-2026-92997","kind":"vulnerability","aliases":["CVE-2026-92997"],"related":[],"title":"WordPress Click n Chat plugin: unauthenticated SQL injection via column parameter","description":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.","summary":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 uses an unvalidated parameter as a SQL column name. An unauthenticated attacker can inject SQL and read or change the site database.","severity":"high","cvss":8.6,"epss":0.00262,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["click-n-chat","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-1.1.3-or-later"],"how_to_check":"Check the installed plugin version in WordPress admin under Plugins, or run: wp plugin get click-n-chat --field=version","fix":"Update the Click n Chat plugin to 1.1.3 or later.","status":"open","published_at":"2026-10-21T06:16:50+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:39:25+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:39:25Z","model":"claude-haiku-5-5","output":{"fix":"Update the Click n Chat plugin to 1.1.3 or later.","reach":"internet","title":"WordPress Click n Chat plugin: unauthenticated SQL injection via column parameter","impact":"high","summary":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 uses an unvalidated parameter as a SQL column name. An unauthenticated attacker can inject SQL and read or change the site database.","category":"package","who_cares":["wordpress","click-n-chat","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker reads or alters site database, including user and password hashes","analyst_note":"","how_to_check":"Check the installed plugin version in WordPress admin under Plugins, or run: wp plugin get click-n-chat --field=version","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-1.1.3-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000473,"input_tokens":2900,"output_tokens":366,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92997':14A,17A '1.1.3':37B,70C 'allow':88C 'attack':49B,90C,95C 'chang':56B 'chat':4A,21B,30B,31B,63C,64C 'click':2A,19B,28B,61C 'click-n-chat':18B 'column':10A,45B,82C 'cve':12A,15A 'databas':59B 'host':25B 'identifi':83C 'inject':8A,51B,94C 'integr':33B,66C 'n':3A,20B,29B,62C 'name':46B 'packag':22B 'paramet':11A,41B,76C 'perform':92C 'plugin':5A,35B,68C 'proper':73C 'queri':87C 'read':54B 'self':24B 'self-host':23B 'site':58B 'sql':7A,44B,52B,86C,93C 'unauthent':6A,48B,89C 'unvalid':40B 'use':38B,78C 'valid':74C 'via':9A 'widget':32B,65C 'wordpress':1A,26B,34B,67C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92997","severity":null,"published_at":"2026-10-21T06:16:50+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92997","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92997","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}