CVE-2026-49082: WordPress Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons plugin <= 1.4.8 - Sensitive Data Exposure vulnerability

Synopsis

This is a sensitive data exposure vulnerability in the Chatway Live Chat WordPress plugin (versions 1.4.8 and earlier). The flaw is reachable over the network by any authenticated user holding a low-privilege subscriber account, with no victim interaction required. Successful exploitation allows an attacker to read, modify, and partially disrupt sensitive data managed by the plugin. No fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; the vulnerable plugin endpoint is exposed via standard HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege subscriber-level WordPress account is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No action by another user or administrator is needed to trigger the exposure.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors need to align.

Blast Radius

• An attacker reads sensitive data handled by the Chatway Live Chat plugin, which may include chat transcripts, visitor contact details, or support ticket contents.
• An attacker modifies plugin-managed data, such as altering chat records or support entries stored by the plugin.
• The plugin's live chat or helpdesk functionality can be partially disrupted, degrading availability for end users relying on the support channel.