CVE-2026-100149 in Connect AI Chat
Summary
by MITRE • 10/03/2026
The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature (attacker-obtained via inline_js identify payload)' parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The WPZOOM Connect plugin for WordPress contains a critical vulnerability that allows unauthenticated attackers to extract sensitive customer data through improper access control mechanisms within its API endpoints. This flaw affects all versions up to and including 4.7.3, specifically involving the x-yamidoo-signature parameter which is generated via an inline JavaScript function identified as inline_js(). The core issue stems from a flawed validation logic where the signature verification process can be bypassed by crafting specific input parameters that manipulate timestamp encoding within email addresses. This architectural weakness enables attackers to impersonate legitimate users or access data belonging to arbitrary victims without possessing valid authentication credentials, representing a severe breach of confidentiality and integrity principles in web application security.
The technical mechanism of this vulnerability relies on the interaction between the plugin's frontend JavaScript code and its backend verification logic. The inline_js() function prints a signature into the page HTML, which is intended to verify requests via the verify_request() function. However, due to insufficient validation constraints, an attacker can register a WooCommerce customer or subscriber-level account using a crafted email address. By encoding the target timestamp and the victim's email address in the local part of this crafted email, the resulting signature generated by inline_js() will pass the verification check for any arbitrary victim on the site. This bypass effectively neutralizes the intended access controls, allowing the attacker to trigger data extraction endpoints that should be restricted to authenticated users or specific authorized contexts.
The operational impact of exploiting this vulnerability is extensive and severe, as it leads to the exposure of comprehensive sensitive information about customers. Attackers can extract full customer profiles including names, WordPress user IDs, detailed order histories, order totals, purchased products, payment method labels, and crucially, EDD Software Licensing license keys along with their status and activation counts. This level of data leakage not only violates privacy regulations such as GDPR or CCPA but also facilitates further attacks such as account takeover, social engineering, or unauthorized software licensing abuse. The fact that both share_customer_data and identify_logged_in settings are enabled by default means that the majority of installations are immediately vulnerable upon installation without requiring any non-default configuration changes from administrators.
From a classification perspective, this vulnerability aligns with CWE-209: Generation of Error Message Containing Sensitive Information and CWE-359: Exposure of Private Personal Information to an Unauthorized Actor. It also maps to MITRE ATT&CK techniques related to Collection via Client Side Scripting and Credential Access through API manipulation. The lack of proper input validation on the email parameter used for signature generation represents a classic case of insecure direct object references combined with broken access control, where the system trusts client-supplied data without adequate server-side verification against expected formats or permissions.
To mitigate this vulnerability, immediate action is required to update the WPZOOM Connect plugin to version 4.7.4 or later, which addresses these flaws in signature generation and request validation logic. Administrators should also review their WordPress user roles and ensure that sensitive data endpoints are not exposed unnecessarily. Implementing strict input validation for email formats used in API signatures can prevent the timestamp encoding attack vector. Additionally, enabling two-factor authentication for all administrative accounts adds a layer of defense against potential follow-on attacks leveraging stolen credentials or license keys. Regular security audits and monitoring of access logs for unusual patterns related to customer data extraction are recommended to detect any exploitation attempts early.