Attack Vectors

Medium severity (CVSS 5.3) information exposure issues are often exploited quietly because they do not require malware or complex steps—just the ability to reach a vulnerable site. In Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty (WordPress plugin slug: chaty) versions up to 3.5.1, an unauthenticated attacker can potentially access exposed data over the network without logging in.

For business leaders, the key point is this: the vulnerability can be probed at scale by opportunistic attackers scanning the internet for affected WordPress sites. Because no user interaction is required, exposure can occur without warning signs that a typical marketing or operations team would notice.

Security Weakness

This issue is categorized as Sensitive Information Exposure (CVE-2026-27370) affecting Chaty in versions ≤ 3.5.1. According to the published advisory, the weakness can allow unauthenticated access to sensitive user or configuration data.

While the advisory does not specify exactly which data fields may be exposed in every environment, the risk is clear: configuration details and user-related information can become accessible to parties who have no legitimate need to see it, increasing downstream security and compliance risk.

Technical or Business Impacts

From a leadership and compliance perspective, the most likely impacts relate to data confidentiality and operational risk. If sensitive configuration or user data is exposed, it can enable account targeting, social engineering, and brand impersonation—threats that frequently translate into customer trust damage and higher support costs.

For regulated organizations, even “limited” exposure can trigger internal incident response requirements, legal review, and potential customer or partner notifications depending on what information is involved. This can create unplanned costs, distract teams from revenue work, and introduce reputational risk that affects pipeline and renewals.

Recommended action: Update Floating Chat Widget – Chaty to version 3.5.2 or newer patched version as the primary remediation.

Similar Attacks

Information exposure in WordPress plugins is a common pattern, and attackers routinely capitalize on it for reconnaissance and follow-on attacks. Here are a few real, well-documented examples of WordPress plugin vulnerabilities that involved unauthorized access or exposure risks:

Elementor (2021): Vulnerability enabling significant unauthorized impact

WooCommerce Payments (2021): Security issue with unauthorized action risk

Essential Addons for Elementor (2023): Publicly reported vulnerability with broad exposure potential