WPPConnect Server versions up to 2.10.74 lack authentication for the /api/:session/chatwoot endpoint, allowing any user to POST message payloads to a connected WhatsApp session. An attacker who knows or guesses a session identifier can use this flaw to transmit arbitrary text or files to any phone number, effectively hijacking the account for spamming, phishing, or other malicious purposes. The vulnerability is a classic example of missing authentication (CWE‑306) and results in unauthorized use of a user's messaging platform, compromising confidentiality and integrity of communications.

The affected product is WPPConnect Server by wppconnect: wppconnect-server. The vulnerability exists in all releases through and including version 2.10.74. Users of earlier or later releases are not susceptible unless those releases reintroduce the same code pattern.

The CVSS score of 8.2 indicates a high severity. EPSS data is not provided, so the current public exploitation probability is uncertain, but the lack of authentication makes the attack straightforward over the exposed HTTP interface. The vulnerability is not present in CISA’s KEV catalog. Attackers can exploit the flaw by sending unauthenticated POST requests to the exposed webhook route, assuming they have knowledge of a valid session name. Due to the absence of authentication checks, the exploitation does not require additional privileges or advanced techniques.