Contact Form To Chat Apps Click To Chat To Order
Monthly
Unauthenticated information disclosure in the 'Contact Form to Chat Apps | Click to Chat to Order' WordPress plugin before 2.15.8 exposes all submitted form entries to any anonymous HTTP client. The plugin registers a public WordPress AJAX action that performs no capability check, nonce verification, or session validation - three standard WordPress authorization layers - allowing any remote actor to dump contact form submissions. A publicly available proof-of-concept exploit exists, reported by WPScan, making opportunistic mass scanning trivial.
Unauthenticated information disclosure in the 'Contact Form to Chat Apps | Click to Chat to Order' WordPress plugin before 2.15.8 exposes all submitted form entries to any anonymous HTTP client. The plugin registers a public WordPress AJAX action that performs no capability check, nonce verification, or session validation - three standard WordPress authorization layers - allowing any remote actor to dump contact form submissions. A publicly available proof-of-concept exploit exists, reported by WPScan, making opportunistic mass scanning trivial.