CVE-2026-121557 — Vulnerability intelligence
—
Published:
- CVSS
- 8.2
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.