CVE-2026-15462 describes an SQL Injection vulnerability in the Sticky Chat Widget plugin for WordPress (versions <=1.4.2). The vulnerability is triggered via the 'scw_form_fields' parameter array keys in the 'scw_save_form_data' AJAX action. The save_form_data() function passes attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping backticks in keys. This allows attackers to break out of the column-identifier list and append arbitrary SQL queries. The use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the validation loop for widget_id is skipped if no valid widget_id is provided, leaving $isValid set to 1 and enabling unauthenticated exploitation to extract sensitive database information.

An unauthenticated attacker can exploit this vulnerability to inject additional SQL queries into existing database operations, potentially extracting sensitive information from the WordPress database. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable AJAX action if possible and monitor for suspicious activity related to the 'scw_save_form_data' AJAX endpoint. Avoid using affected versions (<=1.4.2) in production environments if feasible.