Sensitive Information Exposure in Chat Help WordPress Plugin

Executive Summary

The Chat Help – Click to Chat Button & Form plugin for WordPress has a vulnerability in all versions up to and including 3.1.3. This vulnerability exists because the plugin's REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id} do not perform any authentication or authorization checks.

As a result, unauthenticated attackers can access sensitive information that should be protected.

• Customer names
• Email addresses
• Phone numbers
• WhatsApp messages
• Complete geolocation data including IP addresses, city, country, ISP, and coordinates
• Device fingerprinting information such as browser, operating system, and screen resolution
• WordPress account credentials including user IDs, usernames, emails, and names for logged-in users who submit forms

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id} are accessible without authentication on your WordPress site running the Chat Help – Click to Chat Button & Form plugin version 3.1.3 or earlier.

You can use commands like curl to test access to these endpoints and see if sensitive information is returned without authentication.

• curl -i https://your-wordpress-site.com/wp-json/chat-help/v1/leads
• curl -i https://your-wordpress-site.com/wp-json/chat-help/v1/leads/1

If these commands return sensitive data such as customer names, emails, phone numbers, or WordPress user information without requiring login, your system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts because it allows unauthenticated attackers to extract sensitive personal and account information without any restrictions.

The exposed data includes personal identifiers, contact information, private messages, geolocation details, and WordPress user credentials.

Such exposure can lead to privacy violations, identity theft, targeted phishing attacks, unauthorized access to user accounts, and potential misuse of the collected data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to access sensitive personal data such as customer names, email addresses, phone numbers, geolocation data, device fingerprinting information, and WordPress account credentials. Exposure of such sensitive information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over personal data access and protection.

Because the plugin does not perform authentication or authorization checks on its REST API endpoints, it fails to protect sensitive user data, potentially resulting in unauthorized data disclosure. This undermines the confidentiality requirements mandated by these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Chat Help – Click to Chat Button & Form plugin to a version later than 3.1.3 where this vulnerability is fixed.

If an update is not immediately available, restrict access to the vulnerable REST API endpoints by implementing authentication or IP-based access controls on your web server or firewall.

Additionally, monitor your logs for any suspicious access to these endpoints and consider temporarily disabling the plugin if possible until a patch is applied.

Useful 0 Not Useful 0