CVE-2026-16548 is an unrestricted file upload vulnerability in the Chat Widget: Floating Customer Support Button for 30+ Channels WordPress plugin prior to version 1.8.2. The plugin fails to validate uploaded files at its public response endpoint, allowing unauthenticated attackers to upload arbitrary files. Although the original file extension is discarded and files are stored under a UUID, which prevents direct code execution or stored cross-site scripting, the vulnerability can lead to resource exhaustion through disk consumption and unintended content hosting. Exploitation depends on the configuration of the channel's response storage or mail-forwarding mechanisms.

An unauthenticated attacker can upload arbitrary files to the server, which are stored without their original extensions under a UUID. This prevents direct code execution or stored XSS attacks. The primary impact is potential disk space exhaustion and hosting of arbitrary content, which could affect server availability or lead to unintended content exposure if the response storage or mail-forwarding is configured to serve these files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable public file uploads on the affected endpoint if possible. Monitor and limit disk usage to mitigate potential resource exhaustion. Review and configure channel response storage and mail-forwarding settings to minimize exposure of uploaded files.