CVE-2025-6792CWE-306

One to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interception

Medium · published February 14, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/guppylite/v2/channel-authorize rest endpoint in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to intercept and view private chat messages between users.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00387 · 31.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-02-14T06:42Z
EPSS history
Timeline
  • 14 FEB 06:42Z
    One to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interception
    cvelistv5