CVE-2022-27849 WordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerability

Q: What is CVE-2022-27849?

CVE-2022-27849 is a medium-severity vulnerability in Jeff Starr Simple Ajax Chat (WordPress plugin), published on 15 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2022-27849 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-27849 exists.

Q: How do I fix CVE-2022-27849?

No fix has been published for CVE-2022-27849 yet. Limit exposure of the affected software until one is available.

Medium 5.3 Published 15 Apr 2022 Updated 28 Apr 2026

An attacker can access sensitive information via the sac-export.csv file in the Simple Ajax Chat WordPress plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-27849?

CVE-2022-27849 is a medium-severity vulnerability in Jeff Starr Simple Ajax Chat (WordPress plugin), published on 15 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115

Weakness: CWE-200

Which versions are affected by CVE-2022-27849?

It affects 1 product.

Products include Plugin-Planet Simple Ajax Chat.

How do I fix CVE-2022-27849?

No fix has been published for CVE-2022-27849 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-27849 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-27849 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-hvgg-fv94-2fwq.