Vulnerabilities / WPChat / WPSEC-2026-3066
WPChat <= 1.4.5 - Unauthenticated Sensitive Information Exposure via Settings REST Endpoint
Medium 5.3
CWE-200Fixed in 1.4.6
- ID
- WPSEC-2026-3066
- Plugin
- WPChat – Live Chat & Messaging Widget for Customer Support (smashballoon-wpchat-livechat-customer-support)
- Affected
- all versions before 1.4.6
- Remediation
- Update to 1.4.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- WPChat on WPSec AttackSurface
- Fix released
- Published
Description
The WPChat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the public settings REST route, which returned admin-only Smart Search account fields to any requester. This makes it possible for unauthenticated attackers to retrieve information such as the API token state, token usage, and the newsletter email address that identifies the site to the WPChat API.
References
- https://wpsec.com/vuln/WPSEC-2026-3066/
- https://plugins.svn.wordpress.org/smashballoon-wpchat-livechat-customer-support/tags/1.4.6/
- https://wordpress.org/plugins/smashballoon-wpchat-livechat-customer-support/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS