Live › vulnerability › CVE-2026-103379
The WATI Chat and Notification WordPress plugin through 1.1.8 exposes its stored API token on a public endpoint that requires no secret. An unauthenticated attacker can use that token with a second public endpoint to get the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 06:18 UTC. All times on this page are UTC.
Sites running the WATI Chat and Notification WordPress plugin through version 1.1.8 that also run WooCommerce. The endpoints are reachable in the plugin's default state and are closed only once a WATI account is connected, so sites with a connected account are not exposed through these endpoints. unknown for whether a later plugin version fixes it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| wati-chat-and-notification | wordpress | <= 1.1.8 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.
This page as .md · .json · in your agent: get_signal("CVE-2026-103379")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.