MxChat <= 3.2.27 - Unauthenticated Sensitive Information Exposure via Chat Error Messages
- ID
- WPSEC-2026-2688
- Plugin
- MxChat – AI Chatbot & Content Generation for WordPress (mxchat-basic)
- Affected
- from 3.2.6 before 3.2.28
- Remediation
- Update to 3.2.28 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-209
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- MxChat on WPSec AttackSurface
- Fix released
- Published
Description
The MxChat plugin for WordPress is vulnerable to Sensitive Information Exposure via chat error messages in all versions up to, and including, 3.2.27. This is due to raw error text from Custom Provider (OpenAI-compatible) chat and embedding requests being returned unchanged in the public chat AJAX response. This includes the WordPress HTTP transport error, which names the endpoint's host and port. This makes it possible for unauthenticated attackers to obtain internal backend details, such as the address and port of a self-hosted model server, by sending chat messages while the configured provider fails or cannot be reached.
References
- https://wpsec.com/vuln/WPSEC-2026-2688/
- https://plugins.svn.wordpress.org/mxchat-basic/tags/3.2.28/
- https://wordpress.org/plugins/mxchat-basic/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS