PT-2026-120487

CVE-2026-92999

Published

2026-10-21

Updated

2026-10-21

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Click n Chat (Chat Widget Integration) WordPress plugin versions prior to 1.1.3

Description An authorization check is missing in the lead-export handler, which allows unauthenticated users to download all captured contact records, including names, email addresses, and phone numbers. This occurs via the click n chat update lead list export action handler.

Recommendations Update the plugin to version 1.1.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Mokksh Parekh

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers