CVE-2026-100149

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature (attacker-obtained via inline_js identify payload)' parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.

• CWE-200

• https://github.com/wpzoom/social-icons-widget-by-wpzoom/commit/351a873ac6c99fd8fb63115628a9d612427c3097
• https://plugins.trac.wordpress.org/browser/social-icons-widget-by-wpzoom/tags/4.7.3/includes/classes/class-wpzoom-ai-chat-customer.php#L82
• https://plugins.trac.wordpress.org/browser/social-icons-widget-by-wpzoom/tags/4.7.3/includes/classes/class-wpzoom-ai-chat-customer.php#L93
• https://plugins.trac.wordpress.org/browser/social-icons-widget-by-wpzoom/tags/4.7.3/includes/classes/class-wpzoom-ai-chat.php#L921
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e0c9026c-d83e-41ac-be3a-93a33c32c47b?source=cve

Published

Oct 3, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10014Use after free in WebMIDI in Google Chrome on Android prior …8.3
• CVE-2026-100142The FluentCart A New Era of eCommerce WordPress plugin befo…5.3
• CVE-2026-100143The FluentCart A New Era of eCommerce WordPress plugin befo…6.5
• CVE-2026-100145The Synchrony Financing WordPress plugin before 1.1.2 does n…6.5
• CVE-2026-100147The FunnelKit – Funnel Builder for WooCommerce Checkout plug…7.2
• CVE-2026-100148The Rich Showcase for Google Reviews plugin for WordPress is…6.4
• CVE-2026-10015Integer overflow in WTF in Google Chrome prior to 148.0.7778…8.8
• CVE-2026-100151The Ninja Forms – Contact Form Builder with Calculators, Qui…6.1
• CVE-2026-100152The The All in One SEO – AI SEO Plugin to Boost SEO Rankings…6.5
• CVE-2026-100153The NewStatPress plugin for WordPress is vulnerable to Store…7.2
• CVE-2026-100155The The Ninja Forms – Contact Form Builder with Calculators,…6.5
• CVE-2026-100157The The WP Ultimate Review plugin for WordPress is vulnerabl…6.5