---
id: "CVE-2026-103379"
kind: "vulnerability"
aliases: ["CVE-2026-103379"]
title: "WATI Chat WordPress plugin leaks WooCommerce customer names, addresses and emails"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wati-chat-and-notification", "fixed": [], "affected": "<= 1.1.8", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["e-commerce", "package", "unauthenticated", "wati", "woocommerce", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-newer-than-1.1.8", "wati-account-connected"]
published_at: "2026-11-03T06:17:35+00:00"
first_seen_at: "2026-11-03T06:18:58+00:00"
updated_at: "2026-11-03T06:22:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103379", "first_seen_at": "2026-11-03T06:18:58+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T06:22:18+00:00"}]
---

# WATI Chat WordPress plugin leaks WooCommerce customer names, addresses and emails

The WATI Chat and Notification WordPress plugin through 1.1.8 exposes its stored API token on a public endpoint that requires no secret. An unauthenticated attacker can use that token with a second public endpoint to get the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wati-chat-and-notification affected <= 1.1.8 fixed ?

## How to check

- In WordPress admin go to Plugins and look for 'WATI Chat and Notification' (slug wati-chat-and-notification); version 1.1.8 or earlier is affected.
- Check whether a WATI account is connected in the plugin settings (Plugins > WhatsApp Chat & Notification > Settings, API key pasted). NVD says the endpoints are reachable in the default state and closed only once an account is connected.
- No fixed version is known and the plugin is listed as Removed by Wordfence. If you do not need it, deactivate and delete it, and consider rotating the WATI API key.

## Timeline

- 2026-11-03T06:18:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103379
- 2026-11-03T06:22:18+00:00 analyst — Only the NVD record describes this flaw; no vendor advisory or patch notes found. The plugin listing shows 1.1.8 as the latest version (wordpress.com listing, updated Oct 7 2026), so no fixed version after 1.1.8 is known. Wordfence lists the plugin as Removed (record updated Oct 24 2026) and shows only the older CVE-2025-28925. The exact condition under which a connected WATI account closes the endpoints is stated only in the NVD text; the code was not read.

## Documents

- [advisory] NVD CVE-2026-103379 https://nvd.nist.gov/vuln/detail/CVE-2026-103379
- [mentions] WATI Chat and Notification plugin listing (v1.1.8) https://wordpress.com/plugins/wati-chat-and-notification

## From the sources

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_