{"id":"CVE-2026-15462","aliases":["EUVD-2026-75954","GHSA-x4cw-pxp4-3x6g"],"status":"published","title":"Sticky Chat Widget \u003c= 1.4.2 - Unauthenticated SQL Injection","description":"The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb-\u003einsert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00505,"percentile":0.43676,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-09-11T03:39:34Z","modified":"2026-09-11T15:16:59Z","products":[{"vendor":"gingerplugins","product":"sticky chat widget – floating chat icons, contact form, call, click to chat, email \u0026 message buttons"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a49ba9-02a6-47cf-98f0-053b06036b08?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/sticky-chat-widget/tags/1.4.2/includes/front-end.php#L188"},{"url":"https://plugins.trac.wordpress.org/browser/sticky-chat-widget/tags/1.4.2/includes/front-end.php#L141"},{"url":"https://plugins.trac.wordpress.org/browser/sticky-chat-widget/tags/1.4.2/includes/front-end.php#L60"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3640407%40sticky-chat-widget%2Ftrunk%2Fincludes%2Ffront-end.php\u0026old=3349742%40sticky-chat-widget%2Ftrunk%2Fincludes%2Ffront-end.php\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15462"},{"url":"https://github.com/advisories/GHSA-x4cw-pxp4-3x6g"}],"sources":{"cve":[{"id":"CVE-2026-15462","title":"Sticky Chat Widget \u003c= 1.4.2 - Unauthenticated SQL Injection","description":"The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb-\u003einsert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","status":"published","published":"2026-09-11T03:39:34.125Z","modified":"2026-09-11T14:12:05.799Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-75954","description":"The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb-\u003einsert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","status":"published","published":"2026-09-11T03:39:34Z","modified":"2026-09-11T14:12:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:22.567961Z"}],"ghsa":[{"id":"GHSA-x4cw-pxp4-3x6g","title":"The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the ...","description":"The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb-\u003einsert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","status":"published","published":"2026-09-11T06:31:12Z","modified":"2026-09-11T06:31:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:11:43.788148Z"}],"nvd":[{"id":"CVE-2026-15462","description":"The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb-\u003einsert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","status":"published","published":"2026-09-11T04:17:20.173Z","modified":"2026-09-11T15:16:59.66Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:46.271848Z"}]}}