Click n Chat CVE-2026-92999

No special conditions beyond having the vulnerable plugin installed and active - the lead-export handler in Click n Chat (Chat Widget Integration) versions 1.0.4 up to (but not including) 1.1.3 performs no authorization check, so any remote unauthenticated user can invoke it against a default installation. The only meaningful limiter is exposure scope: exploitation discloses only the contact leads the plugin has already captured (names, emails, phone numbers), so a site with few or no captured leads yields little, and sites already upgraded to 1.1.3 are not affected. No authentication, no user interaction and no non-default configuration are required.

This is a genuine but moderate-impact exposure. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) indicates a remotely reachable flaw requiring no authentication, no user interaction and low complexity - the easiest possible access profile - but impact is limited to confidentiality only, and rated LOW because the disclosed data is captured lead records (names, emails, phone numbers) rather than credentials, system data or code execution. A public exploit exists (per WPScan reference), which raises practical risk since weaponization effort is near zero, but POC availability is NOT the same as active exploitation. There is no CISA KEV listing and no EPSS score in the input, so widespread automated exploitation cannot be confirmed from the data provided. The net picture is a signal of a real, easy-to-exploit privacy/data-leak issue that is a clear priority for any site actually running this plugin, tempered by low technical impact and no evidence of mass exploitation. No key signals conflict with each other here; the main gap is the absence of EPSS and KEV data to gauge real-world exploitation volume.

An unauthenticated attacker discovers a WordPress site running Click n Chat before 1.1.3 and sends a direct request to the plugin's lead-export handler, which performs no authorization check. The handler returns every captured contact record, letting the attacker harvest names, email addresses and phone numbers in bulk for phishing or resale. A public exploit for this is already available via WPScan, lowering the barrier to exploitation.