CVE-2026-103379

Name of the Vulnerable Software and Affected Versions WATI Chat and Notification WordPress plugin versions prior to 1.1.9

Description An issue exists where a public endpoint does not require a valid, non-empty secret to return its stored API token. An unauthenticated attacker can use this token at a second public endpoint to retrieve the order-received URL of any WooCommerce order, allowing them to read the customer's name, address, phone number, and email address. These endpoints are accessible by default and only close after a WATI account is connected.

Recommendations Update the WATI Chat and Notification WordPress plugin to version 1.1.9 or later.