CVE-2026-15291 describes a missing authorization vulnerability in the Chat Help – Click to Chat Button & Form WordPress plugin by themeatelier. The plugin's REST API endpoints for retrieving lead data do not enforce any authentication or authorization, allowing unauthenticated attackers to retrieve sensitive information including customer names, emails, phone numbers, WhatsApp messages, geolocation data (IP, city, country, ISP, coordinates), device fingerprinting details (browser, OS, screen resolution), and WordPress account details (user IDs, usernames, emails, names) of logged-in users who submitted forms. This exposure results from the lack of access control on the endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id}. The vulnerability affects all versions up to and including 3.1.3. No official patch or remediation has been documented at this time.

An unauthenticated attacker can access sensitive personal and account information of users who submitted chat forms via the vulnerable REST API endpoints. This includes personally identifiable information (PII) such as names, emails, phone numbers, and WhatsApp messages, as well as detailed geolocation and device fingerprinting data. Additionally, WordPress account credentials (user IDs, usernames, emails, and names) for logged-in users are exposed. This information disclosure can lead to privacy violations, targeted phishing, social engineering, and further attacks against affected users and the WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable REST API endpoints by implementing custom authentication and authorization controls or disabling the plugin if feasible. Monitor for updates from themeatelier regarding patches or official mitigations.