# WPChat <= 1.4.5 - Unauthenticated Sensitive Information Exposure via Settings REST Endpoint

- **ID:** WPSEC-2026-3066
- **Plugin:** WPChat – Live Chat & Messaging Widget for Customer Support (`smashballoon-wpchat-livechat-customer-support`), https://wordpress.org/plugins/smashballoon-wpchat-livechat-customer-support/
- **Affected versions:** all versions before 1.4.6
- **Fixed in:** 1.4.6 (Update to 1.4.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/smashballoon-wpchat-livechat-customer-support
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3066/

## Description

The WPChat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the public settings REST route, which returned admin-only Smart Search account fields to any requester. This makes it possible for unauthenticated attackers to retrieve information such as the API token state, token usage, and the newsletter email address that identifies the site to the WPChat API.

## References

- https://wpsec.com/vuln/WPSEC-2026-3066/
- https://plugins.svn.wordpress.org/smashballoon-wpchat-livechat-customer-support/tags/1.4.6/
- https://wordpress.org/plugins/smashballoon-wpchat-livechat-customer-support/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3066/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.