CVE-2026-15462

CVE-2026-15462 is an unauthenticated SQL injection vulnerability in the 'scw_save_form_data' AJAX action of the Sticky Chat Widget plugin for WordPress, affecting versions up to and including 1.4.2. The plugin's save_form_data() function passes attacker-controlled POST array keys of the 'scw_form_fields' parameter to $wpdb->insert() without sanitization; because $wpdb->insert() wraps column identifiers in backticks without escaping them, a backtick in a supplied key lets an attacker break out of the identifier list into raw SQL, while the use of filter_input() bypasses WordPress's wp_magic_quotes() protection and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving the $isValid flag set to 1. Successful exploitation allows unauthenticated attackers to append additional SQL queries into already existing queries and use them to extract sensitive information from the site's database. Any WordPress site running Sticky Chat Widget version 1.4.2 or earlier is affected. No public proof-of-concept is known, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported at this time.

What to do: Update the Sticky Chat Widget plugin to a version newer than 1.4.2 as soon as a patched release is available; if patching is not immediately possible, consider deactivating the plugin or using a WAF to restrict unauthenticated POST requests to admin-ajax.php with action=scw_save_form_data. Review web and access logs for unauthenticated requests to admin-ajax.php containing action=scw_save_form_data with backticks or unusual characters in scw_form_fields array keys, which could indicate probing or exploitation, and check database logs for unexpected stacked queries.