The Click n Chat WordPress plugin, when deployed before version 1.1.3, fails to validate the value of the datacolumn parameter before using it as a column identifier in a dynamic SQL statement. An attacker can supply a crafted value to this parameter, causing the plugin to execute arbitrary SQL code. This flaw can lead to the disclosure of sensitive data stored in the database, compromising the confidentiality of the site’s information. The weakness is a classic SQL injection, categorized as CWE-89.

WordPress sites that have the Click n Chat Chat Widget Integration plugin installed with a version older than 1.1.3 are affected. Sites using earlier releases must review their plugin version and apply any available updates.

The CVSS score of 8.6 indicates a high-severity vulnerability. The EPSS score of less than 1% suggests the probability of exploitation is currently low, and the vulnerability is not yet listed in the CISA KEV catalog. The attack path is remote: an attacker can reach the vulnerable endpoint via a standard HTTP request without authentication, adjusting the datacolumn parameter to inject malicious SQL. Exploitation requires only the ability to send crafted requests to the plugin’s endpoint, making it broadly feasible for anyone with network access to the site.