A vulnerability in the Chaty Pro plugin puts thousands of WordPress websites at risk, as attackers could take full control of them.
It is a popular WordPress plugin with approximately 18,000 installations. It offers chat integration with social messaging services.
The vulnerability is tracked as CVE-2025-26776 and allows file uploads in the chaty_front_form_save_data function of the Chaty Pro plugin. Due to a lack of authorization and unnecessary checks, an attacker could exploit the file upload function to insert malicious files. This could ultimately allow an attacker to take control of your WordPress site.
See also: WordPress: Critical vulnerabilities in RealHome theme & Easy Real Estate plugin
Even though the function included a list of allowed file extensions, it was never applied. As a result, the system was vulnerable.
To mitigate the risk, the Chaty Pro plugin developers replaced the use of PHP's move_uploaded_file() with wp_handle_upload(), ensuring proper validation of file extensions and content. The update also includes tighter security measures to prevent unauthorized access.
The vulnerability was discovered and reported on December 9, 2024. After an initial incomplete security update, a final fix was released on February 11, 2025 (version 3.3.4).
“Uploading files directly from users to the server always poses security risks,” PatchStack warned.
See also: W3 Total Cache plugin: Vulnerability puts 1 million WordPress sites at risk
To mitigate these risks, developers should:
- Validate both file extensions and content
- Avoid user-supplied file names
- Use randomized file names that are stored securely
- Restrict uploads of executable files
- Implement appropriate access controls
WordPress site owners using Chaty Pro must update immediately to version 3.3.4.
WordPress Security
WordPress website security requires a multi-pronged approach to protect against potential threats. One key strategy includes regularly updating plugins and themes to ensure that any security vulnerabilities have been patched. Using strong passwords and enabling two-factor authentication adds an extra layer of security. Additionally, regularly backing up your website can protect your data in the event of an attack.
It is also recommended to install a powerful security plugin that offers features such as firewall protection, malware , and brute force attack prevention.
See also: WP3.XYZ malware: Adds fraudulent administrators to 5,000+ WordPress sites
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
By implementing these measures, you can significantly improve the security of your WordPress website.
Importance of WordPress protection
Protecting WordPress websites is especially important for many reasons. First, WordPress websites are very popular, which means they are a prime target for cybercriminals. If your website is not protected, significant damage can occur.
Additionally, an unsecured WordPress site can undermine the trust and credibility you’ve built with customers your. If their data is compromised, they’re more likely to sue you and switch to other companies.
Source: www.infosecurity-magazine.com
