CVE-2026-15291: Chat Help WordPress Plugin Data Exposure

CVE-2026-15291 Overview

The Chat Help – Click to Chat Button & Form plugin for WordPress contains a Sensitive Information Exposure vulnerability affecting all versions up to and including 3.1.3. The flaw resides in the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id}, which lack authentication and authorization checks [CWE-862]. Unauthenticated attackers can enumerate stored lead data over the network. Exposed records include customer names, email addresses, phone numbers, WhatsApp messages, geolocation details, device fingerprints, and WordPress account information for logged-in submitters.

Critical Impact
Remote unauthenticated attackers can harvest personally identifiable information (PII), device fingerprints, and WordPress user metadata directly from vulnerable sites through unauthenticated REST API requests.

Affected Products

Chat Help – Click to Chat Button & Form plugin for WordPress (all versions ≤ 3.1.3)
WordPress installations with the plugin active and lead capture enabled
Sites exposing the /wp-json/chat-help/v1/leads REST endpoints publicly

Discovery Timeline

2026-07-10 - CVE-2026-15291 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15291

Vulnerability Analysis

The plugin registers two REST API routes under the chat-help/v1 namespace for reading lead records collected by the chat widget. The route callbacks defined in src/Admin/Leads.php do not implement a permission_callback that verifies capabilities. As a result, WordPress accepts requests from anonymous clients and returns the full lead dataset. The vulnerability maps to Missing Authorization [CWE-862] and falls into the Sensitive Information Exposure category.

Data returned by the endpoints combines PII with technical telemetry. Records include names, email addresses, phone numbers, WhatsApp message contents, IP addresses, city, country, ISP, latitude and longitude coordinates, browser, operating system, and screen resolution. When a logged-in WordPress user submits the form, the response also includes their user ID, username, email, and display name. Attackers can chain this data for phishing, credential stuffing, or account takeover targeting the exposed WordPress accounts.

Root Cause

The REST route registrations omit an authorization check. The permission_callback argument either returns true or is not enforced, so WordPress does not validate the requester's capability before invoking the handler. Any unauthenticated HTTP client can retrieve the entire leads collection or an individual record by ID.

Attack Vector

An attacker sends a GET request to /wp-json/chat-help/v1/leads on a vulnerable site. The server returns the lead collection as JSON. Iterating over the {id} endpoint retrieves individual records. No credentials, session, or user interaction are required. Attack complexity is low and the endpoint is reachable over the network.

See the WordPress Chat Help Code Reference and the Wordfence Vulnerability Report for the vulnerable route definitions.

Detection Methods for CVE-2026-15291

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/chat-help/v1/leads or /wp-json/chat-help/v1/leads/{id} in web server access logs.
Repeated sequential ID enumeration against the /leads/{id} endpoint from a single source IP.
Anomalous outbound data volume from the site returning JSON responses containing email addresses and phone numbers.
Requests carrying no Cookie, Authorization, or X-WP-Nonce header but reaching lead endpoints successfully.

Detection Strategies

Inspect web server and WAF logs for GET requests targeting the chat-help/v1/leads namespace and alert on unauthenticated 200 responses.
Deploy a signature or rule in the WAF to flag requests to the vulnerable REST paths originating from external IPs.
Correlate high-volume access to /wp-json/chat-help/v1/leads with subsequent phishing or credential stuffing attempts against the same site's wp-login.php.

Monitoring Recommendations

Enable WordPress REST API request logging and forward events to a centralized SIEM for review.
Track the installed version of the Chat Help plugin across managed WordPress sites and alert when version ≤ 3.1.3 is detected.
Monitor for large JSON responses from wp-json endpoints that include email, phone, or geolocation fields.

How to Mitigate CVE-2026-15291

Immediate Actions Required

Update the Chat Help – Click to Chat Button & Form plugin to a version later than 3.1.3 as published in the WordPress Chat Help Changeset.
If a patched version is not yet deployable, deactivate the plugin until the update is applied.
Review web server logs for prior unauthenticated access to the /wp-json/chat-help/v1/leads endpoints and treat any exposed data as compromised.
Notify affected users if PII in lead records was accessible during the exposure window.

Patch Information

The vendor addressed the missing authorization by adding permission checks to the REST route registrations. The corrective changeset is documented in the WordPress Chat Help Changeset. Administrators should apply the update through the WordPress plugin manager and verify the installed version is above 3.1.3.

Workarounds

Block external access to /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id} at the WAF or reverse proxy until patching is complete.
Restrict the WordPress REST API to authenticated users via a security plugin or custom rest_authentication_errors filter that requires a valid capability.
Purge stored lead records that are no longer needed to reduce the volume of PII exposed by any future misconfiguration.

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoints
location ~ ^/wp-json/chat-help/v1/leads {
    deny all;
    return 403;
}