CVE-2026-77773: WordPress Click to Chat Plugin Vulnerability

CVE-2026-77773 Overview

CVE-2026-77773 is an information disclosure vulnerability in the Contact Form to Chat Apps | Click to Chat to Order WordPress plugin in versions before 2.15.8. The plugin exposes a public AJAX action that lacks capability, nonce, and session checks. Unauthenticated attackers can invoke this endpoint over the network to read submitted form entries created with supported third-party form integrations. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve submitted form entries, exposing personal data supplied by site visitors through affected contact forms.

Affected Products

Contact Form to Chat Apps | Click to Chat to Order WordPress plugin versions prior to 2.15.8
WordPress sites integrating the plugin with supported third-party form builders
Any site relying on this plugin for contact form submission handling

Discovery Timeline

2026-09-13 - CVE-2026-77773 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-77773

Vulnerability Analysis

The vulnerability resides in a public AJAX endpoint registered by the plugin. WordPress exposes AJAX handlers through admin-ajax.php, and any action registered with the wp_ajax_nopriv_ prefix is reachable by unauthenticated visitors. The affected handler processes requests without validating the caller's identity or permissions.

Because the plugin omits capability checks, nonce verification, and session validation, any HTTP client can invoke the action and request submitted form entries. The response contains data previously submitted through supported third-party contact forms integrated with the plugin. This includes fields that site operators would reasonably expect to remain restricted to authenticated administrators.

Exploitation requires no authentication and no user interaction, and the attack executes over the network against the WordPress site. The impact is limited to confidentiality; the endpoint does not modify data or affect availability.

Root Cause

The root cause is missing authorization on a wp_ajax_nopriv_ AJAX action. WordPress plugin developers are expected to call current_user_can() for capability enforcement and check_ajax_referer() for nonce validation on any action that returns non-public data. The affected handler skips both controls, so the endpoint behaves as an unauthenticated data retrieval API.

Attack Vector

An attacker sends a crafted POST or GET request to /wp-admin/admin-ajax.php on a vulnerable site, specifying the plugin's action parameter and any required form identifiers. The server returns stored entries in the response body. No credentials, cookies, or nonce tokens are required. Enumeration of form identifiers is straightforward because they are exposed in page markup on public-facing pages.

Refer to the WPScan Vulnerability Report for the affected action name and parameter details.

Detection Methods for CVE-2026-77773

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php referencing the plugin's action parameter
Elevated volume of admin-ajax.php requests from a single IP or ASN with no associated session cookies
HTTP 200 responses to admin-ajax.php containing form field data returned to unauthenticated clients

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php with the plugin's action name and no wordpress_logged_in_* cookie
Deploy a Web Application Firewall (WAF) rule to alert on unauthenticated invocations of the affected AJAX action
Correlate access log entries with response body sizes to identify bulk data retrieval attempts

Monitoring Recommendations

Enable verbose logging on WordPress reverse proxies to capture AJAX action parameters and source IPs
Track baseline traffic patterns for admin-ajax.php and alert on statistical deviations
Review WordPress plugin audit logs, if available, for anomalous access to form submission data

How to Mitigate CVE-2026-77773

Immediate Actions Required

Upgrade the Contact Form to Chat Apps | Click to Chat to Order plugin to version 2.15.8 or later on all WordPress sites
Audit stored form submissions for sensitive data and notify affected data subjects if disclosure is suspected
Restrict access to /wp-admin/admin-ajax.php behind a WAF policy that blocks unauthenticated invocations of the vulnerable action until patching is complete

Patch Information

The plugin vendor released version 2.15.8, which adds the missing authorization checks on the affected AJAX action. Site administrators should apply the update through the WordPress plugin dashboard or by replacing plugin files via WP-CLI. Confirm the installed version reports 2.15.8 or higher after the update. See the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily deactivate the plugin until the patched version is installed
Add a WAF rule that denies unauthenticated requests to admin-ajax.php referencing the vulnerable action parameter
Purge historical form submission data that is no longer required for business purposes to reduce exposure

bash

# Update the plugin using WP-CLI on a vulnerable WordPress host
wp plugin update contact-form-to-any-api --version=2.15.8
wp plugin list --name=contact-form-to-any-api --fields=name,version,status