CVE-2026-15462 in Sticky Chat Widget Plugin
Summary
by MITRE • 09/11/2026
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The Sticky Chat Widget plugin for WordPress contains a critical server-side vulnerability classified as an Unrestricted Upload of File with Dangerous Type or more accurately in this context, an Injection flaw leading to Remote Code Execution via SQL injection. This specific issue resides within the scw_save_form_data AJAX action handler and affects versions up through 1.4.2. The core technical failure stems from how the save_form_data function processes incoming POST data without adequate sanitization or validation of array keys used as column identifiers in database operations. Specifically, when a user submits form data via an unauthenticated HTTP request, the plugin iterates over the provided key-value pairs to insert them into the WordPress database using the $wpdb->insert method. This method is designed to safely handle values by escaping them, but it relies on the assumption that column names are safe identifiers. The function wraps these column names in backticks for SQL syntax compliance but fails to escape or validate the keys themselves before use.
This architectural oversight allows an attacker to exploit a classic injection vector where special characters within input data can alter the structure of the intended SQL command. By supplying array keys that contain backtick characters, such as test` OR 1=1--, the attacker can break out of the expected column identifier context. Because the plugin uses filter_input() to retrieve POST parameters, it inadvertently bypasses WordPress's built-in wp_magic_quotes protection mechanism which typically adds slashes to escape special characters in GET, POST, and COOKIE data. This means that raw malicious payloads are passed directly into the database query construction logic without any intermediate sanitization layer to neutralize dangerous syntax elements like backticks or quotes.
The operational impact of this vulnerability is severe because it enables unauthenticated attackers to perform arbitrary SQL queries against the WordPress database. The validation loop responsible for checking widget IDs is bypassed entirely when no valid widget_id is supplied, leaving an internal validity flag set to true regardless of authentication status. This effectively removes any access control barriers that might have otherwise restricted who can invoke this AJAX action. Consequently, attackers can append additional SQL statements to existing queries, facilitating data exfiltration of sensitive information such as user credentials, session tokens, and other proprietary site data stored in the WordPress database tables.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command commonly known as SQL Injection. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter if the injection leads to further exploitation steps, or more directly T1190 Exploit Public-Facing Application for initial access and data theft. The lack of input validation on dynamic identifiers represents a fundamental failure in secure coding practices where developer trust is placed incorrectly in user-supplied metadata rather than validated against a whitelist of known safe column names.
Mitigation strategies must focus on immediate remediation through software updates and defensive programming adjustments. Administrators should upgrade the Sticky Chat Widget plugin to version 1.4.3 or later where this issue has been addressed by implementing proper input validation for array keys before they are used in database queries. Developers should enforce a whitelist approach for column identifiers, ensuring that only predefined safe strings are allowed as table columns rather than accepting arbitrary user input. Additionally, replacing the use of filter_input with direct $_POST access combined with strict type checking and escaping functions like $wpdb->prepare() can prevent injection attacks by properly handling special characters within both values and structural components of SQL statements. Until patches are applied, disabling the scw_save_form_data AJAX endpoint via server-side configuration or firewall rules is recommended to block exploitation attempts from unauthenticated sources.