WhatsApp MCP Server exposes an unprotected HTTP bridge API that allows sending WhatsApp messages and reading arbitrary files. Before v0.2.1 the '/api/send' endpoint accepts an absolute media_path parameter without directory confinement, and all requests are accepted without authentication or host header checks. The combination lets a local process running under the same user as the bridge send messages from the paired account and attach any readable file as a WhatsApp document, effectively exfiltrating data such as SSH private keys or browser session data. Because no host header validation is performed, a remote attacker can exploit DNS rebinding tricks to reach the bridge from a web page the user visits.

Affected product is WhatsApp MCP Server from verygoodplugins, version 0.1.x and any build before 0.2.1 that listens on 127.0.0.1:8080 without authentication. No explicit version list beyond the threshold; any installation running a pre‑v0.2.1 build is vulnerable.

The vulnerability has a CVSS score of 7.7, indicating moderate to high severity. The EPSS score is less than 1%, showing a very low probability of exploitation at the time of this analysis. The flaw is not listed in CISA KEV. Local attackers can exploit the flaw by running any process under the same user account as the bridge, a common scenario in MCP environments where sibling servers or IDE extensions share a session. Remote attackers could trigger the same behaviour via DNS rebinding, since host header validation is missing and the bridge listens on localhost. Once the bridge is running, the attacker can send unauthorized WhatsApp messages and exfiltrate any file readable by the bridge user, resulting in full confidentiality, integrity and availability impacts.