CVE-2026-15291

Name of the Vulnerable Software and Affected Versions Chat Help – Click to Chat Button & Form versions prior to 3.1.4

Description The plugin fails to perform authentication and authorization checks on the REST API endpoints '/wp-json/chat-help/v1/leads' and '/wp-json/chat-help/v1/leads/{id}'. This allows unauthenticated attackers to extract sensitive information, including customer names, email addresses, phone numbers, WhatsApp messages, and complete geolocation data such as IP addresses, city, country, ISP, and coordinates. Additionally, device fingerprinting information including browser, OS, and screen resolution, as well as WordPress account credentials like user IDs, usernames, emails, and names for logged-in users who submit forms, can be exposed.

Recommendations Update the plugin to a version newer than 3.1.3. Restrict access to the '/wp-json/chat-help/v1/leads' and '/wp-json/chat-help/v1/leads/{id}' endpoints to minimize the risk of exploitation.