The WordPress Click n Chat plugin, in versions before 1.1.3, fails to sanitize the 'sort_by' and 'sort_order' parameters before they are incorporated into an SQL ORDER BY clause. This flaw is a classic SQL injection (CWE‑89) and permits an unauthenticated attacker to inject arbitrary SQL. If successful, the attacker can retrieve sensitive data, modify records, or delete data, leading to loss of confidentiality, integrity, and potentially availability of the application’s database.

The vulnerability affects the Click n Chat WordPress plugin from version 1.0.4 through 1.1.2 and any earlier releases prior to 1.1.3.

With a CVSS score of 8.6 the flaw is classified as critical. The EPSS score is below 1%, indicating a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is an unauthenticated HTTP request where the attacker supplies malicious data in the 'sort_by' or 'sort_order' query parameters. No special privileges are required, and the exploitation can be performed remotely from any network with access to the web application.