FormyChat EUVD-2026-60896

No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation is possible. The FormyChat plugin (version 2.15.7 or earlier) must be installed and active on the target WordPress site. No special server configuration, non-default settings, or user interaction is needed (AC:L, UI:N). What limits exploitation is the requirement that the specific plugin is installed and active, and that the WordPress site is network-reachable; exploitation is constrained to confidentiality impact only (C:H, I:N, A:N), meaning attackers cannot modify data or cause downtime through this vector alone. The scope is unchanged (S:U), so lateral movement to other WordPress components via this CVE alone is not implied.

The CVSS 3.1 score of 7.5 (High) is well-supported by the vector metrics: AV:N (network-reachable without special positioning), AC:L (no race conditions or specialized knowledge required), PR:N (no authentication whatsoever), UI:N (no victim interaction needed), and C:H (significant sensitive data exposure). No EPSS score was provided in the available intelligence, which limits probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog at time of analysis, and no POC code has been confirmed, which moderates the immediate threat level. However, the attack profile - zero prerequisites, fully remote, no user interaction - is exactly the type of flaw that is rapidly picked up by automated WordPress scanning tools and threat actors who target plugin vulnerabilities en masse. The scope is unchanged (S:U), limiting blast radius to the vulnerable system itself. Real-world priority is moderate-to-high for any internet-facing WordPress site running FormyChat 2.15.7 or earlier, given how trivially scannable and exploitable this class of vulnerability is.

An unauthenticated attacker enumerates a target WordPress site for the presence of the FormyChat plugin (e.g., via response headers, plugin asset paths, or a tool like WPScan), then sends a crafted HTTP POST or GET request directly to the vulnerable plugin endpoint - requiring no session token, nonce, or credentials. The missing authorization check allows the request to succeed, returning sensitive data such as stored chat messages, contact form submissions, or plugin configuration containing API keys.