{"id":"CVE-2026-116861","kind":"vulnerability","aliases":["CVE-2026-116861"],"related":[],"title":"Flexible Chat WordPress plugin: unauthenticated users can read sensitive data","description":"Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.","summary":"Flexible Chat versions 1.1.0 and older expose sensitive data to requests that carry no login. An attacker on the internet can fetch that data without any account.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flexible-chat","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Flexible Chat plugin is installed and its version is `1.1.0` or older","fix":"- Move Flexible Chat past `1.1.0`; the fixed version is not named in the sources","status":"open","published_at":"2026-10-30T19:18:15+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:25:58+00:00","updated_at":"2026-10-30T19:25:58+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:25:58Z","model":"claude-haiku-5-5","output":{"fix":"- Move Flexible Chat past `1.1.0`; the fixed version is not named in the sources\n- unknown for any other fix","reach":"internet","title":"Flexible Chat WordPress plugin: unauthenticated users can read sensitive data","impact":"medium","summary":"Flexible Chat versions 1.1.0 and older expose sensitive data to requests that carry no login. An attacker on the internet can fetch that data without any account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","flexible-chat"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated visitors read sensitive site data","analyst_note":"Find the vulnerable endpoint, the exposed data type and the first fixed plugin version on the NVD entry or the plugin's changelog.","how_to_check":"- Check whether the Flexible Chat plugin is installed and its version is `1.1.0` or older\n- unknown for any endpoint or setting that exposes the data","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Flexible Chat plugin at version 1.1.0 or older are exposed to unauthenticated requests. The sources do not say which data is exposed or which configuration is needed, so unknown for the rest. Sites without this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":4062,"output_tokens":524,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116861':13A,16A '-2026':12A,15A '1.1.0':25B,56C 'account':48B 'attack':38B 'carri':34B 'chat':2A,19B,23B,55C 'cve':11A,14A 'data':10A,30B,45B,51C 'expos':28B 'exposur':52C 'fetch':43B 'flexibl':1A,18B,22B,54C 'flexible-chat':17B 'internet':41B 'login':36B 'older':27B 'packag':20B 'plugin':4A 'read':8A 'request':32B 'sensit':9A,29B,50C 'unauthent':5A,49C 'user':6A 'version':24B,57C 'without':46B 'wordpress':3A,21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Flexible Chat plugin at version 1.1.0 or older are exposed to unauthenticated requests. The sources do not say which data is exposed or which configuration is needed, so unknown for the rest. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116861","severity":null,"published_at":"2026-10-30T19:18:15+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}