CVE-2026-28571

HighCVSS 7.5

Published: 18/08/2026(UTC)Updated: 22/10/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

The FormyChat plugin versions up to 2.15.7 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions.

Risk Assessment

The risk includes unauthorized access to sensitive plugin functions, which could lead to data integrity compromise or unauthorized changes.

Recommendation

It is recommended to update the FormyChat plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in FormyChat

CVE-2026-57379High
The FormyChat WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects all versions up to and including 2.15.3.

Original NVD description (English source)

Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS