Session Management Flaw in AskAny WordPress Plugin
CVE-2026-121498
Key Information:
Badges
What is CVE-2026-121498?
The AskAny WordPress plugin, prior to version 2.2.1, suffers from a critical session management vulnerability. This flaw occurs when the plugin fails to verify the ownership of a chat session against the requester, enabling unauthorized users to access another visitor's session identifier. Consequently, these users can read sensitive information such as the visitor's chat transcripts, name, email address, and IP address. Additionally, they can manipulate conversations by adding messages or altering personal details, which poses significant risks to user privacy and data integrity.
Affected Version(s)
AskAny 0 < 2.2.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.