CVE-2026-15291
Received Received - Intake

Sensitive Information Exposure in Chat Help WordPress Plugin

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Wordfence

Description
The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id}. This is due to the plugin not performing any authentication and authorization checks. This makes it possible for unauthenticated attackers to extract sensitive data including customer names, email addresses, phone numbers, WhatsApp messages, complete geolocation data (IP addresses, city, country, ISP, coordinates), device fingerprinting information (browser, OS, screen resolution), and WordPress account credentials (user IDs, usernames, emails, names) for logged-in users who submit forms.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-10
AI Q&A
2026-07-10
EPSS Evaluated
N/A
NVD
CVE-2026-15291
EUVD
EUVD-2026-42800

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordfence chat_help_click_to_chat_button_and_form_plugin to 3.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Chat Help – Click to Chat Button & Form plugin for WordPress has a vulnerability in all versions up to and including 3.1.3. This vulnerability exists because the plugin's REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id} do not perform any authentication or authorization checks.

As a result, unauthenticated attackers can access sensitive information that should be protected.

  • Customer names
  • Email addresses
  • Phone numbers
  • WhatsApp messages
  • Complete geolocation data including IP addresses, city, country, ISP, and coordinates
  • Device fingerprinting information such as browser, operating system, and screen resolution
  • WordPress account credentials including user IDs, usernames, emails, and names for logged-in users who submit forms
Impact Analysis

This vulnerability can have serious impacts because it allows unauthenticated attackers to extract sensitive personal and account information without any restrictions.

The exposed data includes personal identifiers, contact information, private messages, geolocation details, and WordPress user credentials.

Such exposure can lead to privacy violations, identity theft, targeted phishing attacks, unauthorized access to user accounts, and potential misuse of the collected data.

Compliance Impact

This vulnerability allows unauthenticated attackers to access sensitive personal data such as customer names, email addresses, phone numbers, geolocation data, device fingerprinting information, and WordPress account credentials. Exposure of such sensitive information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over personal data access and protection.

Because the plugin does not perform authentication or authorization checks on its REST API endpoints, it fails to protect sensitive user data, potentially resulting in unauthorized data disclosure. This undermines the confidentiality requirements mandated by these standards.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15291. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart