CVE-2026-49082 HIGH

CVE-2026-49082: WordPress Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons plugin <= 1.4.8 - Sensitive Data Exposure vulnerability

Vendor Chatway Live Chat
Product Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; Chat Buttons
Weakness CWE-201
Published June 15, 2026
Last update June 16, 2026
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Subscriber Sensitive Data Exposure in Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; Chat Buttons <= 1.4.8 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Chatway Live Chat versions up to 1.4.8 contain an information disclosure vulnerability affecting multiple security domains. An attacker with low-level privileges can access sensitive data across the application scope, including confidential information, modify certain data, and potentially disrupt service availability. The vulnerability requires network access but no user interaction.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify information, and disrupt service availability across the application.

Potential impact on your site

04Site Impact

Users' data may be exposed or altered; service availability could be affected by authenticated attackers.

Conditions required to exploit

05Prerequisites

Attacker must have low-level user account access; no user interaction required.

Key dates

06Disclosure timeline

June 15, 2026 CVE published
June 16, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57347 WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability CVE-2025-62139 WordPress Terms descriptions plugin <= 3.4.10 - Sensitive Data Exposure vulnerability CVE-2026-24992 WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerability CVE-2026-25008 WordPress Ninja Tables plugin <= 5.2.5 - Sensitive Data Exposure vulnerability CVE-2026-42673 WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability