Vulnerability · Published Oct 6, 2026 · Assigned by Patchstack

CVE-2026-39730WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

High 7.1

In plain English

A high-severity missing authorization in Wise Chat from Marcin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 76.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

Affected products (as reported)

Vendor	Product	Versions
Marcin	Wise Chat	0 – through 3.4.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

References

https://patchstack.com/database/wordpress/plugin/wise-chat/vulnerability/wordpress-wise-chat-plugin-3-4-1-broken-access-control-vulnerability?_s_id=cve vdb-entry