---
id: "CVE-2026-116861"
kind: "vulnerability"
aliases: ["CVE-2026-116861"]
title: "Flexible Chat WordPress plugin: unauthenticated users can read sensitive data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["flexible-chat", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-30T19:18:15+00:00"
first_seen_at: "2026-10-30T19:25:28+00:00"
updated_at: "2026-10-30T19:25:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116861", "first_seen_at": "2026-10-30T19:25:28+00:00"}]
---

# Flexible Chat WordPress plugin: unauthenticated users can read sensitive data

Flexible Chat versions 1.1.0 and older expose sensitive data to requests that carry no login. An attacker on the internet can fetch that data without any account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Flexible Chat plugin is installed and its version is `1.1.0` or older

## Fix

- Move Flexible Chat past `1.1.0`; the fixed version is not named in the sources

## Timeline

- 2026-10-30T19:25:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116861

## From the sources

Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_