Information Exposure in WATI Chat and Notification Plugin
CVE-2026-103379
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 3 November 2026
Badges
What is CVE-2026-103379?
The WATI Chat and Notification WordPress plugin, up to version 1.1.8, has a significant vulnerability where it does not enforce authentication on a public endpoint that exposes its stored API token. This lack of security allows unauthenticated attackers to exploit the endpoint, retrieve the API token, and subsequently gain access to another public endpoint to obtain sensitive WooCommerce order information. This can lead to unauthorized access to customer details, including names, addresses, phone numbers, and email addresses. The vulnerability poses a risk until a WATI account is connected, closing the exposed endpoints.
Affected Version(s)
WATI Chat and Notification 0 <= 1.1.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.