CVE-2026-16548 Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint
Unauthenticated attackers can upload arbitrary files to a WordPress plugin, causing disk consumption and content hosting issues.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16548?
CVE-2026-16548 is a medium-severity vulnerability in Unknown Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.
Weakness: CWE-434
Which versions are affected by CVE-2026-16548?
How do I fix CVE-2026-16548?
No fix has been published for CVE-2026-16548 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16548 being exploited?
There is no known exploitation of CVE-2026-16548 in the wild and no public exploit code.
Sources
Also known as GHSA-5mjf-g86r-2c6f.