{"id":"CVE-2026-121498","kind":"vulnerability","aliases":["CVE-2026-121498"],"related":[],"title":"AskAny WordPress plugin: chat sessions readable and editable by strangers","description":"The AskAny  WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address, and to add messages to their conversation or overwrite their details.","summary":"The AskAny WordPress plugin before 2.2.1 does not check that a chat session belongs to the person asking for it. An unauthenticated attacker who obtains or guesses another visitor's session identifier can read that visitor's chat transcript, name, email address and IP address, and can add messages or overwrite the visitor's details.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["askany","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Look for the AskAny plugin in the WordPress admin under Plugins and note its version","fix":"- Upgrade the AskAny WordPress plugin to `2.2.1` or later","status":"open","published_at":"2026-11-12T06:17:12+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","triaged_at":"2026-11-12T06:37:58+00:00","updated_at":"2026-11-12T06:37:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T06:37:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the AskAny WordPress plugin to `2.2.1` or later","reach":"internet","title":"AskAny WordPress plugin: chat sessions readable and editable by strangers","impact":"medium","summary":"The AskAny WordPress plugin before 2.2.1 does not check that a chat session belongs to the person asking for it. An unauthenticated attacker who obtains or guesses another visitor's session identifier can read that visitor's chat transcript, name, email address and IP address, and can add messages or overwrite the visitor's details.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","askany"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads visitors' chat transcripts, emails and IP addresses","analyst_note":"Confirm the affected plugin slug and how session identifiers are generated or exposed; check the NVD entry for CVSS and the plugin's changelog for the 2.2.1 fix.","how_to_check":"- Look for the AskAny plugin in the WordPress admin under Plugins and note its version\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the AskAny chat plugin for WordPress before 2.2.1 expose stored visitor chats and contact details to anyone holding a session identifier. Sites that do not run this plugin are not affected. The sources do not say how session identifiers are exposed to visitors.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4557,"output_tokens":590,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121498':13A,16A '-2026':12A,15A '2.2.1':28B,83C 'add':70B,127C 'address':64B,67B,121C,124C 'allow':100C 'anoth':50B,107C 'ask':40B 'askani':1A,17B,24B,79C 'attack':45B 'belong':36B,91C 'chang':98C 'chat':4A,34B,60B,89C,117C 'check':31B 'convers':131C 'cve':11A,14A 'detail':77B,135C 'edit':8A 'email':63B,120C 'guess':49B,106C 'identifi':54B,111C 'ip':66B,123C 'messag':71B,128C 'name':62B,119C 'obtain':47B,104C 'overwrit':73B,133C 'packag':18B 'person':39B 'plugin':3A,22B,26B,81C 'read':56B,113C 'readabl':6A 'request':94C 'return':96C 'session':5A,35B,53B,90C,110C 'stranger':10A 'transcript':61B,118C 'unauthent':44B,101C 'user':102C 'verifi':86C 'visitor':51B,58B,75B,108C,115C 'wordpress':2A,19B,21B,25B,80C 'wordpress-plugin':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the AskAny chat plugin for WordPress before 2.2.1 expose stored visitor chats and contact details to anyone holding a session identifier. Sites that do not run this plugin are not affected. The sources do not say how session identifiers are exposed to visitors.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["askany","high","package","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-121498':13A,16A '-2026':12A,15A 'askani':1A 'chat':4A 'cve':11A,14A 'edit':8A 'plugin':3A 'readabl':6A 'session':5A 'stranger':10A 'wordpress':2A","search_b":"'2.2.1':28B 'add':70B 'address':64B,67B 'anoth':50B 'ask':40B 'askani':17B,24B 'attack':45B 'belong':36B 'chat':34B,60B 'check':31B 'detail':77B 'email':63B 'guess':49B 'identifi':54B 'ip':66B 'messag':71B 'name':62B 'obtain':47B 'overwrit':73B 'packag':18B 'person':39B 'plugin':22B,26B 'read':56B 'session':35B,53B 'transcript':61B 'unauthent':44B 'visitor':51B,58B,75B 'wordpress':19B,21B,25B 'wordpress-plugin':20B","search_c":"'2.2.1':83C 'add':127C 'address':121C,124C 'allow':100C 'anoth':107C 'askani':79C 'belong':91C 'chang':98C 'chat':89C,117C 'convers':131C 'detail':135C 'email':120C 'guess':106C 'identifi':111C 'ip':123C 'messag':128C 'name':119C 'obtain':104C 'overwrit':133C 'plugin':81C 'read':113C 'request':94C 'return':96C 'session':90C,110C 'transcript':118C 'unauthent':101C 'user':102C 'verifi':86C 'visitor':108C,115C 'wordpress':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121498","severity":null,"published_at":"2026-11-12T06:17:12+00:00","modified_at":"2026-11-12T06:17:12+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","fetched_at":"2026-11-12T06:36:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}