Description

Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T14:17:02.850Z",
  "pubdate": "2026-08-18T14:17:02.850Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the FormyChat plugin for versions 2.15.7 and below. This security flaw allows unauthenticated remote attackers to interact with vulnerable endpoints or execute unauthorized actions due to missing or improper authorization checks within the affected codebase.\nThe primary impact of this vulnerability involves the potential compromise of confidentiality, integrity, or availability depending on the specific exposed functionality within the FormyChat plugin. Since the flaw does not require any form of authentication or prior privileges, external threat actors operating across the network can directly target the exposed components without needing legitimate user credentials.\nRisk implications are significant for WordPress deployments utilizing the vulnerable product, as unauthorized exploitation could lead to data exposure, unauthorized configuration modifications, or further application-layer compromise.\nExploitation requirements are minimal, primarily consisting of network connectivity to the targeted WordPress site running FormyChat <= 2.15.7 and the ability to send crafted HTTP requests directly to the unauthenticated vulnerable endpoints.",
  "technicalDetails": "The root cause of this vulnerability stems from a failure in the authorization enforcement mechanism within the FormyChat plugin for versions 2.15.7 and prior. Specifically, sensitive functions or REST API endpoints lack proper capability checks and nonce validations, failing to verify whether the incoming request originates from an authenticated user with the appropriate administrative or operational privileges.\nThe vulnerable component resides within the access control logic governing request handling in FormyChat <= 2.15.7. Because the application processes requests without validating user sessions or roles, the attack surface is exposed directly to unauthenticated network traffic.\nThe exploitation method relies on sending HTTP requests (such as GET or POST) directly to the unprotected endpoints exposed by the plugin. The attack flow proceeds as follows: First, the attacker identifies the target URL hosting the vulnerable FormyChat installation. Second, the attacker crafts a malicious HTTP request targeting the specific backend function or endpoint lacking access controls. Third, the application processes the request and executes the underlying logic without challenging the sender for authentication tokens or session cookies. Finally, the attacker achieves unauthorized execution of the targeted functionality.\nAuthentication requirements are absent, meaning attackers do not need to authenticate to the WordPress platform to exploit the flaw. Privilege requirements are similarly nonexistent, allowing any unauthenticated network user to interact with the vulnerable backend handlers. Network exposure is external and broad, as standard web traffic directed at the WordPress site can reach the vulnerable handlers.\nPost-exploitation impact depends on the specific functions exposed by the broken access control flaw, potentially enabling unauthorized data retrieval, setting modifications, or other actions normally restricted to privileged users."
}