This vulnerability (CVE-2026-78268) involves an unauthenticated exposure of sensitive system information in the Lead Generation Contact Widget & AI Chatbot by Extend Themes, specifically in versions up to 1.2.0. The weakness corresponds to CWE-497, indicating exposure of sensitive information to an unauthorized control sphere. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality but not integrity or availability. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

An unauthenticated attacker can access sensitive system information, potentially leading to information disclosure that could aid further attacks. The confidentiality impact is high, but integrity and availability remain unaffected. This exposure could compromise sensitive data handled by the widget and chatbot components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected widget or implementing compensating controls to limit exposure.