CVE-2026-121498 · Package
NO FIX YET · SEE WHAT TO DO
The AskAny WordPress plugin before 2.2.1 does not check that a chat session belongs to the person asking for it. An unauthenticated attacker who obtains or guesses another visitor's session identifier can read that visitor's chat transcript, name, email address and IP address, and can add messages or overwrite the visitor's details.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the AskAny chat plugin for WordPress before 2.2.1 expose stored visitor chats and contact details to anyone holding a session identifier. Sites that do not run this plugin are not affected. The sources do not say how session identifiers are exposed to visitors.
Not affected if plugin-not-installed
Who cares askany, wordpress, wordpress-plugin
2.2.1 or laterThe AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address, and to add messages to their conversation or overwrite their details.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.