CVE-2026-100149 Information disclosure in WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons
Unauthenticated attackers can extract sensitive customer data, including license keys and order history, from the WPZOOM Connect WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100149?
CVE-2026-100149 is a medium-severity vulnerability in WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons, published on 3 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature (attacker-obtained via inline_js identify payload)' parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.
Weakness: CWE-200
Which versions are affected by CVE-2026-100149?
How do I fix CVE-2026-100149?
No fix has been published for CVE-2026-100149 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100149 being exploited?
There is no known exploitation of CVE-2026-100149 in the wild and no public exploit code.
Sources
Also known as GHSA-rhmj-6pg3-6h84.