PT-2026-136231
CVE-2026-121557
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 3.1
5.9
MediumMetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.
Found an issue in the description? Have something to add? Feel free to write us 👾