WordPress Plugin Vulnerabilities

Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entry

Description

The plugin does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form plugin.

Proof of Concept

Affects Plugins

Plugin icon
social-contact-form
Fixed in 2.15.8

References

CVE
CVE-2026-77773

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Vaibhav Narkhede
Submitter
Vaibhav Narkhede
Verified
Yes
WPVDB ID
c4c15701-2149-43b4-b794-38871c0dc734

Timeline

Publicly Published
2026-09-11 (about 2 days ago)
Added
2026-09-11 (about 1 day ago)
Last Updated
2026-09-11 (about 1 day ago)

Other

Published
Title
Published
2021-10-05
Title
Simple Download Monitor < 3.9.6 - Unauthenticated Log Access
Published
2025-10-06
Title
WP Reset < 2.06 - Unauthenticated Sensitive Information Exposure via wf-licensing.log
Published
2024-07-11
Title
WP Popups – WordPress Popup builder < 2.2.0.2 - Unauthenticated Full Path Disclosure
Published
2026-06-17
Title
Visual Link Preview < 2.4.0 - Authenticated (Subscriber+) Sensitive Information Exposure
Published
2025-07-16
Title
JetWooBuilder < 2.1.20.1 - Authenticated (Subscriber+) Information Exposure