WordPress Simple Ajax Chat Plugin Sensitive Data Exposure Vulnerability

A vulnerability allowing the exposure of sensitive system information to an unauthorized control sphere has been identified in the WordPress Simple Ajax Chat plugin, specifically in versions through 20251121. This issue allows embedded sensitive data to be retrieved, potentially leading to the exploitation of other weaknesses within the system. Notably, this vulnerability does not impact users running the Apache web server.

Impact

Exploitation of this vulnerability could allow a malicious actor to access sensitive information that is typically restricted from regular users, creating opportunities to exploit other vulnerabilities within the system.

Remediation

Users of the WordPress Simple Ajax Chat plugin should update to version 20260217 or later. Patchstack users can enable auto-update for vulnerable plugins.