# WPChat <= 1.4.5 - Unauthenticated Missing Authorization to Smart Search Offer Claim

- **ID:** WPSEC-2026-3065
- **Plugin:** WPChat – Live Chat & Messaging Widget for Customer Support (`smashballoon-wpchat-livechat-customer-support`), https://wordpress.org/plugins/smashballoon-wpchat-livechat-customer-support/
- **Affected versions:** all versions before 1.4.6
- **Fixed in:** 1.4.6 (Update to 1.4.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/smashballoon-wpchat-livechat-customer-support
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3065/

## Description

The WPChat plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.4.5 due to the Smart Search claim-offer REST route being protected only by the public widget permission check, which relies on a nonce exposed to all site visitors. This makes it possible for unauthenticated attackers to register the site with the WPChat API using an email address of their choosing and modify the site's private Smart Search settings.

## References

- https://wpsec.com/vuln/WPSEC-2026-3065/
- https://plugins.svn.wordpress.org/smashballoon-wpchat-livechat-customer-support/tags/1.4.6/
- https://wordpress.org/plugins/smashballoon-wpchat-livechat-customer-support/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3065/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.