CVE-2025-6792: Information Disclosure in One to one user Chat

The primary impact of CVE-2025-6792 is the unauthorized exposure of sensitive private chat messages. An attacker can leverage this vulnerability to intercept and view communications between WordPress users who utilize the One to one user Chat plugin. This could lead to the compromise of confidential information, reputational damage, and potential legal repercussions depending on the nature of the conversations. The lack of authentication required to exploit the vulnerability significantly broadens the potential attack surface, making it accessible to a wide range of malicious actors.

1. Reserved2025-06-27
2. Published2026-02-13
3. Modified2026-04-15
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-6792 is to upgrade the One to one user Chat plugin to a version newer than 1.1.4, once a patched version is released by WPGuppy. Until a patch is available, consider temporarily disabling the plugin to prevent unauthorized access to chat messages. As a temporary workaround, restrict access to the /wp-json/guppylite/v2/channel-authorize endpoint using a WordPress firewall or security plugin, although this may impact legitimate plugin functionality. Monitor WordPress access logs for suspicious activity targeting this endpoint.

Active installs

800Niche

Plugin rating