CVE-2026-77773 in Contact Form to Chat Apps Plugin
Summary
by MITRE • 09/13/2026
The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified in versions of the Contact Form to Chat Apps and Click to Chat to Order plugins for WordPress prior to version 2.15.8 represents a critical failure in access control mechanisms within the application's AJAX handling logic. This flaw specifically affects public-facing endpoints that are designed to process user-submitted data from contact forms integrated with chat or ordering applications. The core technical deficiency lies in the absence of essential security validations during the execution of these AJAX actions. Specifically, the plugin fails to verify WordPress capabilities, which determine whether a user has permission to perform specific operations, and it neglects to validate nonces, which are unique tokens used to prevent Cross-Site Request Forgery attacks. Furthermore, there is no session check implemented to ensure that the request originates from an authenticated or legitimate context within the expected workflow. This combination of missing checks creates a significant security gap that allows unauthenticated actors to interact with sensitive backend functions without any form of authentication or authorization verification.
From a technical perspective, this vulnerability falls under the category of Broken Access Control and Insecure Direct Object References as defined by the Common Weakness Enumeration (CWE). CWE-284 describes situations where access control is not properly enforced, allowing users to act outside their intended permissions, while CWE-601 relates to URL redirection to untrusted sites or open redirects that can be exploited for phishing, though in this context, it more directly applies to the lack of integrity checks on data processing endpoints. The absence of nonce validation also aligns with CWE-352, which covers Cross-Site Request Forgery vulnerabilities where a malicious site can cause an authenticated user's browser to perform unwanted actions on a trusted site. In WordPress environments, nonces are critical for ensuring that requests are intentional and originated from the legitimate application interface rather than being forged by external attackers. By omitting these checks, the plugin exposes its internal data processing logic to direct exploitation via simple HTTP POST requests crafted with arbitrary parameters.
The operational impact of this vulnerability is severe due to the nature of the data involved. Since the affected AJAX action allows for reading submitted entries from any form created using the supported third-party integrations, attackers can extract sensitive information provided by legitimate users. This may include personal identifiable information such as names, email addresses, phone numbers, and potentially more detailed contact details or order history depending on the specific configuration of the forms in use. The ability to read these entries without authentication means that an attacker does not need valid credentials for the WordPress admin panel or even a user account on the site itself. This facilitates data exfiltration at scale, as the vulnerability can be automated and applied against any instance running the vulnerable plugin version. Such exposure violates fundamental privacy principles and may lead to non-compliance with regulations such as GDPR or CCPA if personal data is mishandled or exposed without consent.
In terms of threat modeling, this exploitation technique maps directly to the MITRE ATT&CK framework under the Tactic: Collection and specifically the Technique: Screen Capture or Data from Information Repositories, although more accurately it aligns with TA0009 (Collection) via automated data scraping through API abuse. The attack vector is classified as Network-based because it can be executed remotely over HTTP/HTTPS without requiring prior access to the system. Attackers typically exploit this by crafting malicious scripts or using tools like curl to send POST requests to the vulnerable AJAX endpoint, passing parameters that specify which form entries to retrieve. Because there are no rate limits or session constraints mentioned in the vulnerability description, repeated attempts can be made until all available data is harvested. This poses a direct risk of identity theft, spamming campaigns targeting exposed email addresses, and social engineering attacks leveraging the obtained personal information.
Mitigation strategies must focus on immediate remediation through software updates and supplementary security hardening measures. The primary and most effective solution is to upgrade the Contact Form to Chat Apps | Click to Chat to Order plugin to version 2.15.8 or later, where these missing validation checks have presumably been implemented by the developers. Administrators should verify their current plugin versions immediately through the WordPress dashboard and apply updates as soon as they become available. In cases where immediate updating is not feasible due to compatibility concerns with other plugins or custom code modifications, temporary mitigations include restricting access to the wp-admin directory via IP whitelisting if applicable, although this does not fully protect public-facing AJAX endpoints unless specific server-level rules are configured to block unauthorized POST requests to known vulnerable action URLs. Additionally, implementing a Web Application Firewall can help detect and block anomalous traffic patterns associated with automated scraping of form data. Regular security audits and penetration testing should be conducted to ensure that similar access control flaws do not exist in other parts of the WordPress installation or its integrated plugins.