CVE-2026-16548 describes an unrestricted file upload vulnerability (CWE-434) in the Chat Widget: Floating Customer Support Button for 30+ Channels WordPress plugin versions prior to 1.8.2. The plugin does not validate file type, extension, content, or size for files submitted to its public response endpoint, allowing unauthenticated users to upload arbitrary files. Files are stored under a bare UUID without the original extension, which mitigates risks of code execution or stored cross-site scripting. Exploitation impact is limited to disk space consumption and hosting arbitrary content. The vulnerability requires that the channel's response storage or mail-forwarding be configured to be exploitable.

An unauthenticated attacker can upload arbitrary files to the server, potentially consuming disk space or hosting unwanted content. However, the lack of original file extensions and validation prevents direct code execution or stored XSS attacks. The vulnerability's impact is therefore limited to resource consumption and content hosting, not system compromise or data theft.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor file upload endpoints and disable or carefully configure channel response storage or mail-forwarding features to reduce exposure.