File Upload Vulnerability in Chat Widget Plugin for WordPress
CVE-2026-16548
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 4 August 2026
Badges
What is CVE-2026-16548?
The Chat Widget plugin for WordPress versions prior to 1.8.2 is susceptible to a file upload vulnerability. This flaw allows unauthenticated users to upload arbitrary files to the public response endpoint without proper validation of file type, extension, content, or size. Files are stored in the uploads directory with their original extension discarded, being saved under a unique UUID. While this vulnerability does not lead to code execution or stored XSS attacks, it poses a risk of excessive disk usage and unauthorized content hosting, contingent upon the configured storage settings for channel responses or mail forwarding.
Affected Version(s)
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat 0 < 1.8.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.