Security readout for executives and security teams
Plain-English summary
A critical flaw in the WordPress Sticky Chat Widget plugin may let an unauthenticated remote attacker manipulate database queries. Sites running version 1.4.2 or earlier could face disclosure of sensitive database information and limited service disruption. The supplied evidence does not show data modification or confirmed attacks in the wild.
Executive priority
Prioritize immediate inventory and exposure reduction for public WordPress sites. The unauthenticated, low-complexity attack path and high confidentiality impact justify urgent handling, although active exploitation is not established. Escalate any affected public deployment for prompt remediation and log review.
Technical view
CVE-2026-73187 is an unauthenticated SQL injection classified as CWE-89. Its CVSS 3.1 score is 9.3, with network reachability, low attack complexity, no privileges, and no user interaction. The vector rates confidentiality impact high, availability impact low, integrity impact none, and scope changed. The vulnerable parameter and endpoint are not identified.
Likely exposure
Internet-accessible WordPress sites with Sticky Chat Widget enabled at version 1.4.2 or earlier are the likely exposure group. Confirming exposure requires local plugin inventory because the supplied affected record provides no CPEs and lists its structured version value as unavailable.
Exploitation context
The vulnerability is remotely reachable and requires neither authentication nor user interaction according to the CVSS vector. The source bundle does not establish public exploit availability, confirmed exploitation, or CISA KEV inclusion. Treat exploitation status as unconfirmed rather than absent.
Researcher notes
The public summary identifies versions through 1.4.2, but the structured affected entry lists versions as unavailable and supplies no CPEs. No vulnerable endpoint, parameter, proof of concept, fixed version, or vendor mitigation is included. These gaps limit product matching and technical validation; consult the referenced advisory before asserting remediation completeness.
Mitigation direction
- Identify every WordPress site running the Sticky Chat Widget plugin and record its installed version.
- Disable or remove affected versions where operationally acceptable until authoritative remediation guidance is confirmed.
- Check Patchstack and the plugin vendor's guidance for a fixed release or supported mitigation.
- Restrict unnecessary public access and apply relevant WAF protections while remediation is pending.
- Preserve recent database backups and relevant application, web, and security logs.
Validation and detection
- Confirm the plugin slug and version directly from each WordPress installation.
- Verify affected versions are disabled, removed, or upgraded according to authoritative guidance.
- Review web and WAF logs for anomalous requests involving the plugin's routes.
- Review database and application logs for unusual query errors, response patterns, or availability events.
- After remediation, conduct authorized validation without using production-sensitive exploit payloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-73187 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L3.94.7PatchstackVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/wordpress/plugin/sticky-chat-widget/vulnerability/wordpress-sticky-chat-widget-plugin-1-4-2-sql-injection-vulnerability?_s_id=cveCVE reference, Patchstack · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.