CVE-2026-92997: CWE-89 SQL Injection in Click n Chat (Chat Widget Integration)

CVE-2026-92997 is a SQL injection vulnerability in the Click n Chat (Chat Widget Integration) WordPress plugin. Versions prior to 1.1.3 fail to properly validate a parameter before using it as a column identifier in a SQL query, enabling unauthenticated attackers to inject malicious SQL code. This vulnerability is classified under CWE-89. No CVSS score is provided, and no known exploits in the wild have been reported. The vulnerability was published on 2026-10-21.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks against the affected WordPress plugin. This could potentially lead to unauthorized data access or manipulation within the underlying database. The exact impact depends on the database privileges and the queries affected but generally poses a significant risk to data confidentiality and integrity.

Users should upgrade the Click n Chat (Chat Widget Integration) plugin to version 1.1.3 or later, where this vulnerability is fixed. Since no patch links are provided in the input data, users should verify the availability of the fix from the official plugin source or vendor advisory. Until patched, restricting access to the plugin's functionality or disabling it may reduce exposure.