CVE-2026-121498

A visitor could read or change another person’s AskAny chat

AskAny maintainers · AskAny WordPress AI chatbot

First documented disclosure · Review checkpoint

Summary

The plugin used the chat session identifier without verifying session ownership. A visitor could read transcripts and personal details, add messages, or overwrite another visitor’s details.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The plugin used the chat session identifier without verifying session ownership.

Conditions required

An unauthenticated visitor obtained or guessed the identifier of another chat session.

Potential impact

A visitor could read transcripts and personal details, add messages, or overwrite another visitor’s details.

Affected versions and configurations

Before 2.2.1.

Fix and mitigation status

2.2.1.

Practical next steps

Upgrade AskAny to 2.2.1 or later. The updated plugin also removes public access to sessions created before 2.2.0.

Operating lesson

Bind every chat read and write to the visitor who owns the session.

Evidence and limits

The maintainer changelog dates the fix and ownership issue to November 8. WPScan published November 10. The CVE record was published on 2026-11-12. WPScan displays 4.8 without a CVSS version. The CNA supplies no scored vector.

Sources