CVE-2025-6792

MEDIUM

WPGuppy plugin <1.1.4 - Info Disclosure

Title source: llm
STIX 2.1

Description

The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/guppylite/v2/channel-authorize rest endpoint in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to intercept and view private chat messages between users.

Exploits (1)

nomisec WORKING POC
by jFriedli · poc
https://github.com/jFriedli/CVE-2025-6792

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.0002
EPSS Percentile 6.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (1)
amentotechpvtltd/One to one user Chat by WPGuppy < 1.1.4
Published Feb 14, 2026
Tracked Since Feb 18, 2026