Skip to content
Threat Feed
Subscribe

Vendor

Chat Help

1 brief RSS
high advisory

CVE-2026-15291: WordPress Chat Help Plugin Sensitive Information Exposure

Unauthenticated attackers can exploit CVE-2026-15291, a vulnerability in the Chat Help - Click to Chat Button & Form WordPress plugin (versions up to and including 3.1.3), due to a lack of authentication and authorization checks on specific REST API endpoints (/wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id}), allowing them to extract sensitive user data, including names, email addresses, phone numbers, WhatsApp messages, complete geolocation data, device fingerprinting, and WordPress account credentials for logged-in users who submitted forms.

Chat Help – Click to Chat Button & Form plugin for WordPress wordpress plugin information-disclosure rest-api cve
1r 2t 1c