CVE-2026-6251 describes an authenticated time-based blind SQL injection vulnerability in Chaty Pro for WordPress, affecting versions up to and including 3.5.5. The vulnerability is due to the fetch_custom_field() function in admin/class-admin-base.php retrieving the widget_id POST parameter via filter_input(INPUT_POST, ...) and directly concatenating it into a raw SQL query in a numeric context without using $wpdb->prepare() or integer casting. Additionally, nonce verification is performed after the SQL query execution, providing no protection against injection. This allows authenticated attackers with subscriber-level privileges or higher to inject arbitrary SQL commands, potentially extracting sensitive database contents such as user credentials and configuration data. The CVSS 3.1 base score is 6.5 (medium severity), with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation is currently documented, and no known exploits are reported in the wild.

An attacker with subscriber-level or higher authenticated access can exploit this vulnerability to perform time-based blind SQL injection attacks. This can lead to unauthorized disclosure of sensitive database information, including user credentials and configuration data. The vulnerability does not affect integrity or availability but has a high confidentiality impact. Exploitation requires network access and valid credentials but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity. Avoid using vulnerable versions of Chaty Pro. Since nonce verification occurs after query execution, it does not mitigate this issue. Implementing proper input validation and using prepared statements or integer casting in the affected function is necessary once a patch is released.