{
 "id": "WPSEC-2026-2688",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2688/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2688/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2688/index.md",
 "title": "MxChat <= 3.2.27 - Unauthenticated Sensitive Information Exposure via Chat Error Messages",
 "description": "The MxChat plugin for WordPress is vulnerable to Sensitive Information Exposure via chat error messages in all versions up to, and including, 3.2.27. This is due to raw error text from Custom Provider (OpenAI-compatible) chat and embedding requests being returned unchanged in the public chat AJAX response. This includes the WordPress HTTP transport error, which names the endpoint's host and port. This makes it possible for unauthenticated attackers to obtain internal backend details, such as the address and port of a self-hosted model server, by sending chat messages while the configured provider fails or cannot be reached.",
 "plugin": {
  "slug": "mxchat-basic",
  "name": "MxChat",
  "full_name": "MxChat – AI Chatbot & Content Generation for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/mxchat-basic/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mxchat-basic/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mxchat-basic"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-209"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.2.6",
    "from_inclusive": true,
    "to": "3.2.28",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.2.6 before 3.2.28"
  ]
 },
 "introduced_in": "3.2.6",
 "fixed_in": "3.2.28",
 "remediation": "Update to 3.2.28 or later.",
 "fix_released": "2026-11-06T02:36:41+00:00",
 "published": "2026-11-07T02:40:41+00:00",
 "updated": "2026-11-06T12:02:36.851466+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2688/",
  "https://plugins.svn.wordpress.org/mxchat-basic/tags/3.2.28/",
  "https://wordpress.org/plugins/mxchat-basic/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mxchat-basic",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-07"
 }
}