EUVD-2026-52601
GHSA-5mjf-g86r-2c6f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
AC:H reflects non-default channel configuration prerequisite; PR:N per description's unauthenticated claim; A:L added for disk exhaustion; S:C for content served externally.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.
AnalysisAI
Unrestricted file upload in the Chat Widget WordPress plugin before 1.8.2 allows any network-reachable user to submit arbitrary files to the plugin's public response endpoint, bypassing all validation of type, extension, content, and size. Uploaded files are stored in the WordPress uploads directory under bare UUIDs - stripping the original extension - which explicitly prevents code execution or stored XSS despite the CWE-434 classification. Real-world impact is bounded to disk exhaustion and abuse of the hosting environment to serve attacker-controlled static content, conditional on the channel's response storage or mail-forwarding feature being configured. No public exploit identified via CISA KEV; however, a proof-of-concept is publicly available per WPScan, and EPSS at 0.16% (6th percentile) signals minimal observed exploitation activity.
Technical ContextAI
CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: the plugin's public-facing response endpoint performs no server-side validation of MIME type, file extension, magic bytes, or file size before persisting uploads. The affected product is identified by CPE as the 'Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat' WordPress plugin, versions prior to 1.8.2. The mitigating technical detail is that the plugin discards the original file extension at storage time, renaming each file to a bare UUID. On standard PHP/Apache or PHP/nginx stacks, a file without a recognized executable extension (e.g., .php) is served as a static binary blob, not interpreted, so remote code execution via web shell is prevented. The residual attack surface is limited to disk exhaustion (uploading large files in volume) and using the WordPress uploads directory as a free content-delivery vector for arbitrary data. The attack requires the channel's response storage or mail-forwarding feature to be actively configured, making this a conditional vulnerability rather than one exploitable against all default installations.
RemediationAI
The primary fix is upgrading the Chat Widget plugin to version 1.8.2 or later via the WordPress plugin repository; the vendor patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/14d5f86b-f0ab-4920-99d0-8e2a66486232/. If immediate upgrade is not feasible, disabling the channel's response storage and mail-forwarding configuration eliminates the exploitable code path entirely, as the CVE description explicitly states the vulnerability requires this feature to be active. Administrators can also implement web server-level restrictions (nginx or Apache) to block POST requests to the plugin's public response endpoint URI, though this will break legitimate customer-facing functionality. Additionally, configuring server-side upload size limits (PHP upload_max_filesize and post_max_size) in php.ini to minimal values will reduce disk exhaustion risk if patching is delayed. Note that since extension stripping already prevents code execution, the residual risk during the patch window is limited to content abuse and disk pressure rather than server compromise.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today