The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin prior to version 2.15.8 contains an information exposure vulnerability (CWE-200). Specifically, one of its public AJAX actions lacks proper capability, nonce, or session validation, enabling unauthenticated attackers to access submitted entries of any form created with supported third-party forms. This vulnerability is identified as CVE-2026-77773 with a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality.

Unauthenticated users can read submitted form entries, potentially exposing sensitive user data collected through forms integrated with the plugin. There is no impact on integrity or availability reported. The exposure is limited to data confidentiality.

A fixed version 2.15.8 or later is implied but not explicitly confirmed in the input data. Since no patch links or vendor advisory are provided, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, restrict access to the AJAX endpoint or disable the plugin if possible.