The Click n Chat WordPress plugin before version 1.1.3 does not perform an authorization check on its lead‑export handler, allowing any internet user to download all contact records collected by the widget. The disclosed data includes names, email addresses and phone numbers, constituting a breach of user confidentiality and mapping directly to the confidentiality weakness described by CWE‑200.

Any WordPress site that has installed the Click n Chat (Chat Widget Integration) plugin in versions 1.0.4 through 1.1.2 is affected. No other WordPress components are impacted by this flaw, and the vulnerability was fixed by the 1.1.3 release. Sites using earlier releases must upgrade or disable the export feature to eliminate the flaw.

The CVSS score of 5.3 indicates medium severity, while an EPSS score of less than 1% implies a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the disclosure by simply making an HTTP request to the click_n_chat_update_lead_list_export_action endpoint; no authentication or special permissions are required. Because the endpoint is publicly exposed, exploitation is straightforward, but current reported usage remains limited.