Platform
wordpress
Component
chatlive
Fixed in
2.0.2
CVE-2025-27302 describes a SQL Injection vulnerability discovered in the CHATLIVE WordPress plugin. This flaw allows attackers to inject malicious SQL code, potentially leading to unauthorized data access and manipulation. The vulnerability impacts versions from 0.0.0 through 2.0.1, and a patch is available in version 2.0.2.
Successful exploitation of this SQL Injection vulnerability could grant an attacker complete control over the underlying database. They could extract sensitive user data, including usernames, passwords, and personal information. Furthermore, an attacker could modify or delete data, disrupt the plugin's functionality, or even gain access to the entire WordPress installation. The potential for data exfiltration and system compromise makes this a high-severity risk, particularly for sites relying on CHATLIVE for critical functionality.
CVE-2025-27302 was publicly disclosed on 2025-04-17. The vulnerability's simplicity and the widespread use of WordPress plugins suggest a potential for exploitation. While no public exploits have been confirmed at the time of writing, the CRITICAL CVSS score indicates a high probability of exploitation if left unpatched. Monitor security advisories and threat intelligence feeds for any signs of active campaigns targeting this vulnerability.
Exploit Status
EPSS
0.23% (46% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-27302 is to immediately upgrade the CHATLIVE plugin to version 2.0.2 or later. If upgrading is not feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent exploitation. Implementing a Web Application Firewall (WAF) with SQL Injection protection rules can provide an additional layer of defense. Regularly review WordPress plugin security best practices and ensure all plugins are from trusted sources.
Update the CHATLIVE plugin to the latest available version to mitigate the SQL Injection vulnerability. Check for plugin updates directly in the WordPress admin panel or through the official WordPress.org repository. Implement additional security measures, such as user input validation and sanitization, to prevent future vulnerabilities.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-27302 is a critical SQL Injection vulnerability affecting the CHATLIVE WordPress plugin, allowing attackers to inject malicious SQL code and potentially access sensitive data.
If you are using CHATLIVE version 0.0.0 through 2.0.1 on your WordPress site, you are vulnerable to this SQL Injection vulnerability.
Upgrade the CHATLIVE plugin to version 2.0.2 or later to resolve the vulnerability. If immediate upgrade is not possible, disable the plugin temporarily.
While no confirmed active exploitation has been reported, the CRITICAL severity suggests a high probability of exploitation if the vulnerability remains unpatched.
Refer to the CHATLIVE plugin's official website or WordPress plugin repository for the latest security advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.