medium · CVSS v3 5.3

CVE-2026-103379

The WATI Chat and Notification WordPress plugin (v1.1.8 and earlier) exposes two public endpoints that do not enforce authentication or a se

Overview

The WATI Chat and Notification WordPress plugin (v1.1.8 and earlier) exposes two public endpoints that do not enforce authentication or a secret key. An unauthenticated attacker can retrieve the stored API token and then use it to query order details from WooCommerce, leaking customer personal data. This flaw allows data exposure of customer names, addresses, phone numbers, and email addresses.

Description

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.

Impact

Confidentiality of customer data is compromised, exposing names, addresses, phone numbers, and email addresses. The vulnerability does not affect integrity or availability. Website owners using the plugin and their customers are directly impacted.

Remediation

Upgrade the plugin to version 1.1.9 or later where the endpoints require a valid secret. If an upgrade is not possible, configure the plugin to disable the public endpoints or enforce authentication. Ensure the WATI account is connected before enabling the plugin.

Risk context

The vulnerability has a medium severity (CVSS 5.3) and no EPSS data is available. It poses a moderate risk of data exposure for sites using the affected plugin.

Affected products

  • WATI Chat and Notification plugin
  • WordPress

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

wordpress plugin data-exposure authentication-bypass woocommerce cve-2026-103379 medium-severity

← All CVEs

Related CVEs

medium

CVE-2026-105605

An IDOR flaw in the Joomla DJ-Classifieds extension allows any logged‑in user to retrieve the full details of any advertisement by supplying its numeric ID. The issue exists in all versions prior to 3.11.3 and exposes sensitive advertiser information such as phone numbers, addresses, and prices. It can be exploited without any special privileges or external access.

View analysis

medium

CVE-2026-120524

The News Kit Addons For Elementor plugin for WordPress is vulnerable to stored XSS via the formData parameter, allowing authenticated subscribers to inject arbitrary scripts. These scripts execute whenever a user views an affected page, enabling defacement or data theft. The flaw stems from insufficient sanitization and an operator-precedence bug that exposes the admin bundle to subscriber-level screens.

View analysis

medium

CVE-2026-120544

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.

View analysis

medium

CVE-2026-120551

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.

View analysis