CVE-2026-78268: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere in Extend Themes Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads

This vulnerability (CVE-2026-78268) in Extend Themes' Lead Generation Contact Widget & AI Chatbot (Chat Button, Phone Call, Telegram, Email – SiteLeads) versions <=1.2.0 allows unauthenticated attackers to access sensitive system information. The issue is categorized as CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. The CVSS v3.1 score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

An unauthenticated attacker can gain access to sensitive system information, potentially aiding further attacks or reconnaissance. The confidentiality impact is high, but integrity and availability are not affected. This exposure could lead to increased risk of targeted attacks or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit exposure of the affected widget and monitor for unusual activity. Avoid deploying affected versions in sensitive environments if possible.