CVE-2026-39730
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A missing authorization vulnerability in Marcin Wise Chat (wise-chat) allows exploiting incorrectly configured access control security levels. This affects versions through 3.4.3.
Risk Assessment
An attacker could gain unauthorized access to chat features, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update the Wise Chat plugin to the latest version and review access control configuration.
Other vulnerabilities in Wise Chat
See all- CVE-2026-81784High
A vulnerability in the Wise Chat plugin (versions up to 3.4.2) involves deserialization of untrusted data, allowing Object Injection. This can lead to unauthorized actions in the application.
- CVE-2026-66636Medium
Stored XSS vulnerability in the Wise Chat plugin by Marcin. Improper input neutralization during page generation allows persistent execution of malicious scripts.
Original NVD description (English source)
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS