The plugin fails to enforce a non‑empty secret on a public endpoint that returns the stored API token. An unauthenticated attacker can retrieve this token and then call a second public endpoint that reveals the order‑received URL for any WooCommerce order, exposing the customer’s name, address, phone number and email address. The vulnerability allows full disclosure of personally identifiable information for every order processed through the affected plugin.

WATI Chat and Notification WordPress plugin, versions 1.1.8 or earlier.

The exposed endpoints are reachable on any site that has installed the plugin in its default state and are closed only after a WATI account is connected. Because authentication is not required, the attack can be performed remotely from any IP address. The vulnerability is not currently listed in CISA’s KEV catalog and no EPSS score is available, but the information disclosure is severe, potentially impacting customer trust and regulatory compliance. A successful exploitation could lead to extensive personal data exposure and fraud risk for customers.