CVE-2026-92999: Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action

Q: Which deployments are affected?

Click n Chat (Chat Widget Integration) versions before 1.1.3 are affected. The reported affected range includes versions 1.0.4 through 1.1.2.

Q: Does exploitation require a WordPress account or prior authentication?

No. The lead-export handler lacks an authorization check, so unauthenticated users can download the captured contact records.

Q: What information can be exposed?

An attacker can download every captured contact record, including names, email addresses, and phone numbers.

Q: What is the remediation?

Update the plugin to version 1.1.3 or later.

Published Oct 21, 2026

Updated

The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone numbers).

Affected Software

1 affected component

Click n Chat Click n Chat (Chat Widget Integration)<1.1.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Click n Chat (Chat Widget Integration) WordPress plugin to a version that resolves this vulnerability.
Fixed in 1.1.3

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Click n Chat (Chat Widget Integration) versions before 1.1.3 are affected. The reported affected range includes versions 1.0.4 through 1.1.2.

Does exploitation require a WordPress account or prior authentication?

No. The lead-export handler lacks an authorization check, so unauthenticated users can download the captured contact records.

What information can be exposed?

An attacker can download every captured contact record, including names, email addresses, and phone numbers.

What is the remediation?

Update the plugin to version 1.1.3 or later.

CVE-2026-92999: Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require a WordPress account or prior authentication?

What information can be exposed?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require a WordPress account or prior authentication?

What information can be exposed?

What is the remediation?