CVE-2026-103379
WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.
| Vendor | unknown |
| Product | wati chat and notification |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wati chat and notification
Be the first to know when new unknown vulnerabilities affecting unknown wati chat and notification are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WATI Chat and Notification
0 ≤ 1.1.8
References
Credits
Naoki Kawahigashi WPScan