{
 "id": "WPSEC-2026-3065",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3065/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3065/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3065/index.md",
 "title": "WPChat <= 1.4.5 - Unauthenticated Missing Authorization to Smart Search Offer Claim",
 "description": "The WPChat plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.4.5 due to the Smart Search claim-offer REST route being protected only by the public widget permission check, which relies on a nonce exposed to all site visitors. This makes it possible for unauthenticated attackers to register the site with the WPChat API using an email address of their choosing and modify the site's private Smart Search settings.",
 "plugin": {
  "slug": "smashballoon-wpchat-livechat-customer-support",
  "name": "WPChat",
  "full_name": "WPChat – Live Chat & Messaging Widget for Customer Support",
  "wordpress_org": "https://wordpress.org/plugins/smashballoon-wpchat-livechat-customer-support/",
  "advisories_url": "https://wpsec.com/vuln/plugin/smashballoon-wpchat-livechat-customer-support/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/smashballoon-wpchat-livechat-customer-support"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.4.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.4.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.4.6",
 "remediation": "Update to 1.4.6 or later.",
 "fix_released": "2026-11-12T13:24:14+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:16:09.523494+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3065/",
  "https://plugins.svn.wordpress.org/smashballoon-wpchat-livechat-customer-support/tags/1.4.6/",
  "https://wordpress.org/plugins/smashballoon-wpchat-livechat-customer-support/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/smashballoon-wpchat-livechat-customer-support",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}