WordPress Plugin Vulnerabilities

Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons < 1.4.9 - Authenticated (Subscriber+) Information Exposure

Description

The Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
chatway-live-chat
Fixed in 1.4.9

References

CVE
CVE-2026-49082
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/16429860-d2a6-4b08-b2da-012ec2d4e2c3

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
dodoh4t
Verified
No
WPVDB ID
3595f9fb-c045-4cf2-ad3f-5d16a862a19b

Timeline

Publicly Published
2026-06-05 (about 29 days ago)
Added
2026-06-10 (about 23 days ago)
Last Updated
2026-06-10 (about 23 days ago)

Other

Published
Title
Published
2024-10-14
Title
Contact Forms, Live Support, CRM, Video Messages < 1.11.1 - Unauthenticated Information Disclosure
Published
2025-01-06
Title
Duplicate Post, Page and Any Custom Post < 3.5.6 - Authenticated (Contributor+) Post Disclosure via Post Duplication
Published
2024-06-04
Title
Open Graph < 1.11.3 - Unauthenticated Sensitive Information Exposure
Published
2024-08-08
Title
My Custom CSS PHP & ADS <= 3.3 - Unauthenticated Full Path Disclosure
Published
2024-06-27
Title
SEO SIMPLE PACK < 3.3.0 - Information Exposure