WordPress Plugin Vulnerabilities

Contact Form to Chat Apps | Click to Chat to Order – FormyChat < 2.15.8 - Missing Authorization

Description

The Contact Form to Chat Apps | Click to Chat to Order – FormyChat plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.15.7. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
social-contact-form
Fixed in 2.15.8

References

CVE
CVE-2026-28571
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e7acbe-90a9-4cc9-a109-b7fda0761a0a

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Doan Dinh Van
Verified
No
WPVDB ID
781adc83-3c58-4329-8237-8593c10a0959

Timeline

Publicly Published
2026-08-17 (about 1 month ago)
Added
2026-09-02 (about 17 days ago)
Last Updated
2026-09-16 (about 3 days ago)

Other

Published
Title
Published
2026-06-23
Title
RentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action
Published
2022-05-23
Title
Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls
Published
2026-02-09
Title
The Conference < 1.2.6 - Missing Authorization
Published
2024-07-17
Title
Meks Video Importer < 1.0.13 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification
Published
2025-12-03
Title
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI < 3.41.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term Manipulation