CVE-2026-16548
Received Received - Intake

Arbitrary File Upload in Chat Widget WordPress Plugin

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: WPScan

Description
The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-16548
EUVD
EUVD-2026-52601

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects a WordPress plugin called Chat Widget: Floating Customer Support Button for 30+ Channels. The flaw allows unauthenticated users to upload arbitrary files to the server through a public endpoint without validation of file type, extension, content, or size. Files are stored in the uploads directory with a UUID filename, discarding the original extension.

Detection Guidance

Check the WordPress uploads directory for unexpected files, particularly UUID-named files without extensions. Review server logs for POST requests to the plugin's public response endpoint.

Impact Analysis

The impact is limited to disk consumption and content hosting. An attacker could fill up server storage by uploading many large files. Additionally, the uploaded files could be hosted publicly if the plugin's response storage or mail-forwarding features are configured.

Mitigation Strategies

Update the Chat Widget plugin to version 1.8.2 or later. If unable to update, disable the plugin immediately. Monitor disk usage and remove any unauthorized files from the uploads directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16548. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart