Live › vulnerability › CVE-2026-92999
Go to dashboardThe Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 has a lead-export handler with no authorization check. An unauthenticated visitor can download every captured contact record, including names, email addresses and phone numbers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 that have captured leads through the widget. Sites without this plugin, or running 1.1.3 or later, are not affected.
No product ranges from the sources yet.
wp plugin get click-n-chat --field=version1.1.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone numbers).
This page as .md · .json · in your agent: get_signal("CVE-2026-92999")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.