Wppconnect Server
Monthly
WPPConnect Server through 2.10.74 allows unauthenticated remote attackers to send arbitrary WhatsApp text or file messages from a connected session by POSTing crafted Chatwoot webhook payloads to /api/:session/chatwoot, a route registered without the verifyToken middleware. Exploitation is constrained: the endpoint must be reachable and the attacker must know or guess a session name whose client is in CONNECTED status; random or secret session names reduce risk, while default or disclosed names make abuse straightforward. No public exploit was identified at time of analysis, and the vendor references an upstream fix in PR #2702.
WPPConnect Server through 2.10.74 allows unauthenticated remote attackers to send arbitrary WhatsApp text or file messages from a connected session by POSTing crafted Chatwoot webhook payloads to /api/:session/chatwoot, a route registered without the verifyToken middleware. Exploitation is constrained: the endpoint must be reachable and the attacker must know or guess a session name whose client is in CONNECTED status; random or secret session names reduce risk, while default or disclosed names make abuse straightforward. No public exploit was identified at time of analysis, and the vendor references an upstream fix in PR #2702.