{"id":"CVE-2026-92998","kind":"vulnerability","aliases":["CVE-2026-92998"],"related":[],"title":"WordPress Click n Chat plugin: unauthenticated SQL injection via sort parameter","description":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.","summary":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 passes sort parameters into a SQL ORDER BY clause without sanitising them. An unauthenticated attacker can inject SQL to read or change the site's database.","severity":"high","cvss":8.6,"epss":0.00262,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["click-n-chat","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Check the installed plugin version in wp-admin under Plugins, or run: wp plugin get click-n-chat --field=version (unknown if the slug differs).","fix":"Update the Click n Chat plugin to version 1.1.3 or later.","status":"open","published_at":"2026-10-21T06:16:50+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:39:22+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:39:22Z","model":"claude-haiku-5-5","output":{"fix":"Update the Click n Chat plugin to version 1.1.3 or later.","reach":"internet","title":"WordPress Click n Chat plugin: unauthenticated SQL injection via sort parameter","impact":"high","summary":"The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 passes sort parameters into a SQL ORDER BY clause without sanitising them. An unauthenticated attacker can inject SQL to read or change the site's database.","category":"package","who_cares":["wordpress","click-n-chat"],"confidence":0.6,"needs_auth":"no","worst_case":"database contents readable and writable by unauthenticated attackers","analyst_note":"Confirm the affected endpoint, whether the plugin's default config exposes it, and the plugin slug at https://nvd.nist.gov/vuln/detail/CVE-2026-92998.","how_to_check":"Check the installed plugin version in wp-admin under Plugins, or run: wp plugin get click-n-chat --field=version (unknown if the slug differs).","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000506,"input_tokens":2904,"output_tokens":432,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92998':14A,17A '1.1.3':34B,71C 'allow':86C 'attack':49B,88C,93C 'chang':56B 'chat':4A,21B,27B,28B,64C,65C 'claus':43B,85C 'click':2A,19B,25B,62C 'click-n-chat':18B 'cve':12A,15A 'databas':60B 'inject':8A,51B,92C 'integr':30B,67C 'n':3A,20B,26B,63C 'order':41B,83C 'packag':22B 'paramet':11A,37B,76C 'pass':35B 'perform':90C 'plugin':5A,32B,69C 'read':54B 'sanitis':45B,74C 'site':58B 'sort':10A,36B,75C 'sql':7A,40B,52B,82C,91C 'unauthent':6A,48B,87C 'use':78C 'via':9A 'widget':29B,66C 'without':44B 'wordpress':1A,23B,31B,68C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92998","severity":null,"published_at":"2026-10-21T06:16:50+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92998","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92998","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}