Vulnerability · Published Nov 3, 2026 · Assigned by WPScan

CVE-2026-103379WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

Medium 5.3

In plain English

A medium-severity information exposure in WATI Chat and Notification from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 89.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WATI Chat and Notification	0 – through 1.1.8

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/0018daf6-9fbe-4b80-8a9e-60950ddaa4fe/ exploit, vdb-entry, technical-description