{"id":"CVE-2026-103379","kind":"vulnerability","aliases":["CVE-2026-103379"],"related":[],"title":"WATI Chat WordPress plugin leaks WooCommerce customer names, addresses and emails","description":"The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.","summary":"The WATI Chat and Notification WordPress plugin through 1.1.8 exposes its stored API token on a public endpoint that requires no secret. An unauthenticated attacker can use that token with a second public endpoint to get the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wati-chat-and-notification","fixed":[],"affected":"<= 1.1.8","ecosystem":"wordpress"}],"ecosystems":[],"tags":["e-commerce","package","unauthenticated","wati","woocommerce","wordpress","wordpress-plugin"],"not_affected_if":["plugin-newer-than-1.1.8","wati-account-connected"],"how_to_check":"- In WordPress admin go to Plugins and look for 'WATI Chat and Notification' (slug wati-chat-and-notification); version 1.1.8 or earlier is affected.\n- Check whether a WATI account is connected in the plugin settings (Plugins > WhatsApp Chat & Notification > Settings, API key pasted). NVD says the endpoints are reachable in the default state and closed only once an account is connected.\n- No fixed version is known and the plugin is listed as Removed by Wordfence. If you do not need it, deactivate and delete it, and consider rotating the WATI API key.","fix":null,"status":"open","published_at":"2026-11-03T06:17:35+00:00","first_seen_at":"2026-11-03T06:18:58+00:00","triaged_at":"2026-11-03T06:20:55+00:00","updated_at":"2026-11-03T06:22:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T06:20:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WATI Chat WordPress plugin leaks WooCommerce customer names, addresses and emails","impact":"medium","summary":"The WATI Chat and Notification WordPress plugin through 1.1.8 exposes its stored API token on a public endpoint that requires no secret. An unauthenticated attacker can use that token with a second public endpoint to get the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wati","e-commerce"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attackers read WooCommerce customer personal data","analyst_note":"Confirm whether a fixed plugin version exists after 1.1.8 and the exact condition under which a WATI account blocks the endpoints.","how_to_check":"- Check whether the WATI Chat and Notification plugin is installed and its version is `1.1.8` or earlier, in the WordPress plugins screen or the plugin's main file header.\n- Confirm whether a WATI account is connected; the sources say the endpoints are closed only once one is connected.\n- unknown for any other check, as the sources do not say how to test the endpoints.","plain_action":"","needs_analyst":true,"not_affected_if":["wati-account-connected","plugin-newer-than-1.1.8"],"who_is_affected":"Sites running the WATI Chat and Notification WordPress plugin through version 1.1.8 that also run WooCommerce. The endpoints are reachable in the plugin's default state and are closed only once a WATI account is connected, so sites with a connected account are not exposed through these endpoints. unknown for whether a later plugin version fixes it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4189,"output_tokens":661,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm whether a fixed plugin version exists after 1.1.8 and the exact condition under which a WATI account blocks the endpoints.","search":"'-103379':14A,17A '-2026':13A,16A '1.1.8':42B,98C,166C 'account':177C 'address':9A,85B,147C,152C 'and':21A 'api':46B,116C 'attack':58B,121C 'chat':2A,20A,36B,92C,160C 'close':172C 'commerc':25B 'connect':179C 'custom':7A,82B,144C 'cve':12A,15A 'default':168C 'e':24B 'e-commerc':23B 'email':11A,89B,151C 'empti':106C 'endpoint':51B,67B,111C,129C,154C 'expos':43B 'get':69B 'leak':5A 'name':8A,84B,146C 'non':105C 'non-empti':104C 'notif':38B,94C,162C 'notification':22A 'number':87B,149C 'obtain':131C 'order':72B,78B,134C,140C 'order-receiv':71B,133C 'packag':26B 'phone':86B,148C 'plugin':4A,33B,40B,96C,164C 'present':124C 'public':50B,66B,110C,128C 'reachabl':156C 'read':80B,142C 'receiv':73B,135C 'requir':53B,101C 'return':113C 'second':65B,127C 'secret':55B,107C 'state':169C 'store':45B,115C 'token':47B,62B,117C 'unauthent':27B,57B,120C 'url':74B,136C 'use':60B 'valid':103C 'wati':1A,19A,28B,35B,91C,159C,176C 'wati-chat-and-notification':18A 'woocommerc':6A,29B,77B,139C 'wordpress':3A,30B,32B,39B,95C,163C 'wordpress-plugin':31B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WATI Chat and Notification WordPress plugin through version 1.1.8 that also run WooCommerce. The endpoints are reachable in the plugin's default state and are closed only once a WATI account is connected, so sites with a connected account are not exposed through these endpoints. unknown for whether a later plugin version fixes it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["watichatandnotification"],"ptokens":["and","chat","notification","wati"],"labels":["ecommerce","high","package","unauthenticated","wati","woocommerce","wordpress","wordpressplugin"],"first_public_at":"2026-11-03T06:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103379","severity":null,"published_at":"2026-11-03T06:17:35+00:00","modified_at":"2026-11-03T06:17:35+00:00","first_seen_at":"2026-11-03T06:18:58+00:00","fetched_at":"2026-11-03T06:18:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103379:1461","url":null,"severity":null,"published_at":"2026-11-03T06:22:18+00:00","modified_at":"2026-11-03T06:22:18+00:00","first_seen_at":"2026-11-03T06:22:18+00:00","fetched_at":"2026-11-03T06:22:18+00:00","note":"Only the NVD record describes this flaw; no vendor advisory or patch notes found. The plugin listing shows 1.1.8 as the latest version (wordpress.com listing, updated Oct 7 2026), so no fixed version after 1.1.8 is known. Wordfence lists the plugin as Removed (record updated Oct 24 2026) and shows only the older CVE-2025-28925. The exact condition under which a connected WATI account closes the endpoints is stated only in the NVD text; the code was not read."}],"documents":[{"id":55980,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103379","title":"NVD CVE-2026-103379","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":55981,"url":"https://wordpress.com/plugins/wati-chat-and-notification","title":"WATI Chat and Notification plugin listing (v1.1.8)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}