CVE-2025-6792

The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/guppylite/v2/channel-authorize rest endpoint in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to intercept and view private chat messages between users.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wordpress.org/plugins/wpguppy-lite/
https://www.wordfence.com/threat-intel/vulnerabilities/id/03774303-c9f4-4666-ac88-78f92aaf81dc?source=cve

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) El plugin One to one user Chat de WPGuppy para WordPress es vulnerable a acceso no autorizado a datos debido a una falta de comprobación de capacidad en el endpoint REST /wp-json/guppylite/v2/channel-authorize en todas las versiones hasta la 1.1.4, inclusive. Esto hace posible que atacantes no autenticados intercepten y vean mensajes de chat privados entre usuarios.

14 Feb 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-14 07:16

Updated : 2026-06-17 10:02

NVD link : CVE-2025-6792

Mitre link : CVE-2025-6792

CVE.ORG link : CVE-2025-6792

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-6792", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6792", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T20:15:53.138914Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "amentotechpvtltd", "product": "One to one user Chat by WPGuppy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-02-14T07:16:07.270", "references": [{"url": "https://wordpress.org/plugins/wpguppy-lite/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03774303-c9f4-4666-ac88-78f92aaf81dc?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/guppylite/v2/channel-authorize rest endpoint in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to intercept and view private chat messages between users."}, {"lang": "es", "value": "El plugin One to one user Chat de WPGuppy para WordPress es vulnerable a acceso no autorizado a datos debido a una falta de comprobaci\u00f3n de capacidad en el endpoint REST /wp-json/guppylite/v2/channel-authorize en todas las versiones hasta la 1.1.4, inclusive. Esto hace posible que atacantes no autenticados intercepten y vean mensajes de chat privados entre usuarios."}], "lastModified": "2026-06-17T10:02:34.800", "sourceIdentifier": "security@wordfence.com"}