themeatelier ChatHelp Plugin up to 3.1.3 REST API leads information disclosure

Summaryinfo

A vulnerability categorized as problematic has been discovered in themeatelier ChatHelp Plugin up to 3.1.3. This issue affects some unknown processing of the file /wp-json/chat-help/v1/leads of the component REST API. Executing a manipulation can lead to information disclosure. This vulnerability is tracked as CVE-2026-15291. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in themeatelier ChatHelp Plugin up to 3.1.3 and classified as problematic. This vulnerability affects an unknown functionality of the file /wp-json/chat-help/v1/leads of the component REST API. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id}. This is due to the plugin not performing any authentication and authorization checks. This makes it possible for unauthenticated attackers to extract sensitive data including customer names, email addresses, phone numbers, WhatsApp messages, complete geolocation data (IP addresses, city, country, ISP, coordinates), device fingerprinting information (browser, OS, screen resolution), and WordPress account credentials (user IDs, usernames, emails, names) for logged-in users who submit forms.

The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-15291 since 07/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/10/2026). The MITRE ATT&CK project declares the attack technique as T1592.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Chat Software

Vendor

• themeatelier

Name

• ChatHelp Plugin

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion