Vulnerabilities / WPChat / WPSEC-2026-3065
WPChat <= 1.4.5 - Unauthenticated Missing Authorization to Smart Search Offer Claim
Medium 5.3
CWE-862Fixed in 1.4.6
- ID
- WPSEC-2026-3065
- Plugin
- WPChat – Live Chat & Messaging Widget for Customer Support (smashballoon-wpchat-livechat-customer-support)
- Affected
- all versions before 1.4.6
- Remediation
- Update to 1.4.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- WPChat on WPSec AttackSurface
- Fix released
- Published
Description
The WPChat plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.4.5 due to the Smart Search claim-offer REST route being protected only by the public widget permission check, which relies on a nonce exposed to all site visitors. This makes it possible for unauthenticated attackers to register the site with the WPChat API using an email address of their choosing and modify the site's private Smart Search settings.
References
- https://wpsec.com/vuln/WPSEC-2026-3065/
- https://plugins.svn.wordpress.org/smashballoon-wpchat-livechat-customer-support/tags/1.4.6/
- https://wordpress.org/plugins/smashballoon-wpchat-livechat-customer-support/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS