{
 "id": "WPSEC-2026-3066",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3066/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3066/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3066/index.md",
 "title": "WPChat <= 1.4.5 - Unauthenticated Sensitive Information Exposure via Settings REST Endpoint",
 "description": "The WPChat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the public settings REST route, which returned admin-only Smart Search account fields to any requester. This makes it possible for unauthenticated attackers to retrieve information such as the API token state, token usage, and the newsletter email address that identifies the site to the WPChat API.",
 "plugin": {
  "slug": "smashballoon-wpchat-livechat-customer-support",
  "name": "WPChat",
  "full_name": "WPChat – Live Chat & Messaging Widget for Customer Support",
  "wordpress_org": "https://wordpress.org/plugins/smashballoon-wpchat-livechat-customer-support/",
  "advisories_url": "https://wpsec.com/vuln/plugin/smashballoon-wpchat-livechat-customer-support/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/smashballoon-wpchat-livechat-customer-support"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.4.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.4.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.4.6",
 "remediation": "Update to 1.4.6 or later.",
 "fix_released": "2026-11-12T13:24:14+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:16:09.523494+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3066/",
  "https://plugins.svn.wordpress.org/smashballoon-wpchat-livechat-customer-support/tags/1.4.6/",
  "https://wordpress.org/plugins/smashballoon-wpchat-livechat-customer-support/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/smashballoon-wpchat-livechat-customer-support",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}