CVE-2026-27370: 
WordPress vulnerability analysis and mitigation

CVE-2026-27370 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) in the Premio Chaty WordPress plugin, versions 3.5.1 and earlier. It allows unauthenticated remote attackers to retrieve embedded sensitive data from affected WordPress sites. The vulnerability was reported by researcher "daroo" on November 23, 2025, and publicly disclosed on March 5, 2026. It carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Patchstack, NVD).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses or transmitted data that should not be accessible to unauthenticated users. The attack vector is network-based, requires no privileges and no user interaction, and has low attack complexity — making it trivially exploitable by any remote attacker. Patchstack notes that due to the specific nature of this vulnerability, no virtual patch can be assigned, underscoring that a code-level fix is the only remediation (Patchstack).

Successful exploitation allows an unauthenticated attacker to retrieve sensitive information embedded in data sent by the Chaty plugin, which could include configuration details, API keys, or other credentials used by the plugin to integrate with third-party chat services. The confidentiality impact is rated High, with no integrity or availability impact. Exposed sensitive data could be leveraged to further compromise the WordPress site or connected third-party services (Patchstack, NVD).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.018% (0.000180), indicating a low probability of exploitation in the near term. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity (Patchstack).

The vendor (Premio) has released version 3.5.2 of the Chaty plugin, which resolves this vulnerability. Site administrators should update the Chaty plugin to version 3.5.2 or later immediately. No configuration-based workaround is available, and Patchstack has confirmed that no virtual patch can be applied for this specific vulnerability type. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

Sucuri included CVE-2026-27370 in their March 2026 vulnerability patch roundup, highlighting it as one of several WordPress plugin issues requiring attention (Sucuri Blog). No significant additional vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.