PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-16548 Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat CVE debrief

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured. Administrators and users of the Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin, especially those with public response endpoints configured, should be aware of this vulnerability and take necessary actions to secure their installations. To address this vulnerability, verify the plugin version and update to 1.8.2 or later if necessary. Restrict access to the public response endpoint and monitor for suspicious file uploads and system storage usage. Consider implementing additional security measures such as Web Application Firewall (WAF) rules to detect and prevent malicious file uploads.

Vendor
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat
Product
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-04
Original CVE updated
2026-08-11
Advisory published
2026-08-04
Advisory updated
2026-08-11

Who should care

Administrators and users of the Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin, especially those with public response endpoints configured, should be aware of this vulnerability and take necessary actions to secure their installations.

Technical summary

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint. This allows an unauthenticated user to upload arbitrary files, which are stored under a UUID without their original extension. The impact is limited to disk consumption and content hosting, as the original extension is discarded, preventing code execution or stored XSS.

Defensive priority

Medium-priority vulnerability in a WordPress plugin allowing unauthenticated file uploads, potentially leading to disk consumption and content hosting.

Recommended defensive actions

  • Verify the plugin version and update to 1.8.2 or later if necessary.
  • Restrict access to the public response endpoint.
  • Monitor for suspicious file uploads and system storage usage.
  • Consider implementing additional security measures such as Web Application Firewall (WAF) rules to detect and prevent malicious file uploads.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate file uploads. Impact is limited to disk consumption and content hosting due to file storage under a UUID without the original extension.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T07:16:30.593Z and has not been modified since then.