---
id: "CVE-2026-121498"
page: "https://infrastack.ai/live/CVE-2026-121498"
kind: "vulnerability"
aliases: ["CVE-2026-121498"]
title: "AskAny WordPress plugin: chat sessions readable and editable by strangers"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["askany", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-12T06:17:12+00:00"
first_seen_at: "2026-11-12T06:36:51+00:00"
updated_at: "2026-11-12T06:37:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121498", "first_seen_at": "2026-11-12T06:36:51+00:00"}]
exploit_sources: []
---

# AskAny WordPress plugin: chat sessions readable and editable by strangers

Link for people: https://infrastack.ai/live/CVE-2026-121498 (this .md is for agents)

The AskAny WordPress plugin before 2.2.1 does not check that a chat session belongs to the person asking for it. An unauthenticated attacker who obtains or guesses another visitor's session identifier can read that visitor's chat transcript, name, email address and IP address, and can add messages or overwrite the visitor's details.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the AskAny plugin in the WordPress admin under Plugins and note its version

## Fix

- Upgrade the AskAny WordPress plugin to `2.2.1` or later

## Timeline

- 2026-11-12T06:36:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121498

## From the sources

The AskAny  WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address, and to add messages to their conversation or overwrite their details.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_