The Chaty Pro plugin for WordPress contains an Authenticated Time‑Based Blind SQL Injection vulnerability that occurs when the widget_id POST parameter is unsafely concatenated into a raw SQL query within admin/class-admin-base.php. The nonce verification is performed after the query, giving attackers no protection. The flaw allows subscribers and higher‑privileged users to inject arbitrary SQL statements, potentially retrieving sensitive database contents such as user credentials and configuration data.

Chaty Pro plugin, WordPress, versions up to and including 3.5.5. Authenticated users possessing the subscriber role or higher can exploit the flaw.

The CVSS score of 6.5 places this issue in the medium‑severity range, and the EPSS score of less than 1% suggests low likelihood of widespread exploitation at present. It is not listed in the CISA KEV catalog. Attackers must be logged into the WordPress site with a subscriber or higher role and must be able to send crafted POST requests to the widget management endpoint. Upon exploitation, the attacker can retrieve or manipulate database rows, jeopardizing confidentiality and integrity of stored data.