WPPConnect Server CVE-2026-121557

Exploitation requires the WPPConnect Server Chatwoot webhook endpoint (POST /api/:session/chatwoot) to be network-reachable, and the attacker must know or guess a valid session name that is currently in CONNECTED status - this is the concrete AT:P attack requirement. The flaw exists because the route was registered without the verifyToken middleware (per src/routes/index.ts line 963 and PR #2702), so no WPPConnect session token is validated. Limiting factors: the target session must be active/connected, and the attacker must enumerate or otherwise learn the session name; where session names are random or secret, exploitation is meaningfully harder, whereas default, sequential, or disclosed session names make it trivial. No user interaction and no authentication are required (PR:N).

This is a genuine, prioritizable issue rather than a high-score-but-low-risk finding, though its real-world blast radius is constrained. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N, 8.2) describes a network-reachable, unauthenticated flaw whose only gate is the AT:P attack requirement - the attacker must know or guess a valid connected session name - and whose impact is integrity-focused (VI:H: sending arbitrary WhatsApp messages/files from the victim account; SI:L: those messages reach downstream WhatsApp recipients), with no confidentiality or availability impact. The vuln.today Decision label is 'this_week', consistent with a serious but not emergency-grade issue: there is no CISA KEV listing (so no confirmed active exploitation) and no EPSS score was supplied, so widespread opportunistic scanning cannot be quantified. No working exploit code is referenced - the GitHub issue (#2701) and VulnCheck advisory document the flaw and fix, not a weaponized PoC. The signals are internally consistent: a patch is available (PR #2702), the root cause is confirmed in source, and the only real friction for an attacker is enumerating a live session name. Treat this as a prompt-patch item on this-week urgency, not a drop-everything emergency, but note that the session-name requirement is weak if session names are predictable or disclosed.

An attacker locates an internet-exposed WPPConnect Server and sends an unauthenticated POST to /api/<session>/chatwoot using a known or guessed connected session name, supplying a Chatwoot-style 'message_created' outgoing event with an attacker-chosen phone number and body. Because the verifyToken middleware was absent on this route, the server relays the text or file to any WhatsApp number from the victim's connected account. No public working exploit code is identified at time of analysis, but the request shape is fully documented in the source and advisory.