Flexible Chat CVE-2026-116861

Exploitation requires only that a target run the WordPress 'Flexible Chat' plugin by wpdesk at version 1.1.0 or earlier and that it be network-reachable; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are stated as prerequisites. The available sources do not specify which plugin feature, endpoint, or configuration triggers the disclosure or what sensitive data is returned, so any further conditions are not described in the evidence. The primary limiting factor is deployment footprint: only sites with this specific plugin installed at an affected version are exposed; there is no stated non-default-configuration or version-specific caveat beyond the <= 1.1.0 range.

The signals here are modest and internally consistent, which argues against treating this as an emergency despite the 7.5 'High' base score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw with high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N) - i.e. a pure read/disclosure issue, not code execution or takeover. The vuln.today priority is 'this_week' rather than act_now or emergency, and the issue is NOT on the CISA KEV list, so there is no confirmed active exploitation. No EPSS probability was supplied, and no public exploit or PoC reference is present - the only reference is the Patchstack advisory itself, which is a vendor/database writeup, not working exploit code. So the picture is: a disclosure bug in a WordPress plugin, network-reachable without authentication, but with no evidence of exploitation in the wild and no known PoC. The main uncertainty is substantive: the description ('Unauthenticated Sensitive Data Exposure') and CWE-201 do not state WHAT data is exposed or HOW the flaw is triggered, so the real-world impact of C:H cannot be independently verified - if the exposed data is low-sensitivity, the practical risk is lower than the score implies. This is a real-but-bounded 'patch-this-week' disclosure issue rather than a widespread-exploitation priority.

A remote attacker, without any authentication or user interaction, sends requests to a WordPress site running the Flexible Chat plugin at version 1.1.0 or earlier and receives sensitive information that should not be disclosed. No public exploit code or PoC is identified, and the exact data exposed and trigger mechanism are not described in the available sources. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, any such request would require no special positioning or privileges.