Description

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-13T06:16:24.680Z",
  "pubdate": "2026-09-13T06:16:24.680Z",
  "executiveSummary": "The 'Contact Form to Chat Apps | Click to Chat to Order' WordPress plugin prior to version 2.15.8 contains an Insecure Direct Object Reference (IDOR) vulnerability resulting in unauthorized sensitive data exposure.\nThis vulnerability exists due to a lack of authorization checks and nonces on a public AJAX action, allowing unauthenticated remote attackers to query and retrieve private form submissions stored by the plugin.\nThe impact is significant, as it leads to the mass harvesting of potentially PII-sensitive customer data without requiring prior authentication or administrative privileges.\nThe risk is critical for any WordPress site utilizing this plugin, as the attack vector is simple and does not require complex prerequisites to exploit.",
  "technicalDetails": "The vulnerability originates from an improperly secured AJAX action within the 'Contact Form to Chat Apps | Click to Chat to Order' plugin. Analysis indicates that the plugin registers an AJAX endpoint intended for internal functionality; however, it fails to implement essential WordPress security hooks such as check_ajax_referer() to validate nonces or current_user_can() to verify administrative capabilities.\nBecause these security controls are absent, the endpoint remains globally accessible to unauthenticated users via standard HTTP POST requests. When the specific AJAX action is invoked, the underlying controller function processes the request without validating the requester's session or permissions. This allows an attacker to perform direct, unauthorized database queries or API interactions to retrieve records generated by the plugin's form handling mechanism.\nThe attack flow proceeds as follows: 1) The attacker identifies the exposed AJAX action endpoint, typically defined in the plugin's core JavaScript or PHP registration hooks. 2) The attacker crafts an HTTP request containing the necessary action parameter. 3) The server-side code executes the logic to fetch form entries. 4) The server returns the requested data—which often includes user-submitted content such as names, phone numbers, email addresses, and order details—directly to the attacker's client.\nSince the plugin does not enforce a scope check on the data being requested, an attacker can iterate through sequential IDs or parameters if the backend implementation supports it, potentially leading to the leakage of all submitted form data stored in the WordPress database. This exposure bypasses all standard WordPress authorization layers, granting anonymous users complete access to private business intelligence and user-submitted data. The vulnerability remains present in all versions prior to 2.15.8, where developers ultimately implemented the required nonce validation and capability checks to restrict access to authenticated administrators only."
}