Is CVE-2026-100149 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100149 being exploited in the wild.

How severe is CVE-2026-100149?

Medium severity, with a CVSS score of 5.3, published 3 October 2026.

Is there a fix for CVE-2026-100149?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100149 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100149?

Check whether you run WPZOOM Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100149: WPZOOM Connect plugin sensitive information exposure via signature validation bypass

CVE-2026-100149 · Severity: medium · CVSS 5.3 · Published 2026-10-03

The WPZOOM Connect WordPress plugin, which provides AI chat and social sharing features, exposes sensitive customer data including payment methods, order history, and license keys. An unauthenticated attacker can extract this information for any customer by registering an account with a specially crafted email address that bypasses the plugin's signature validation. No special privileges or configuration changes are required since the vulnerable features are enabled by default.

Vendors: WPZOOM.

Quick answers

Is CVE-2026-100149 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100149 being exploited in the wild.
How severe is CVE-2026-100149?: Medium severity, with a CVSS score of 5.3, published 3 October 2026.
Which products and versions are affected?: WPZOOM Connect up to 4.7.3.
Is there a fix for CVE-2026-100149?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100149 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100149?: Check whether you run WPZOOM Connect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a signature validation bypass in the WPZOOM_AI_Chat_Customer class's verify_request() function. An attacker can register a WooCommerce customer or subscriber account with a malicious email address whose local part encodes a target timestamp and victim email, causing the inline_js() function to generate a valid signature for an arbitrary victim email. This allows extraction of customer card data (name, user ID, order history, payment methods, EDD license keys) through the x-yamidoo-signature parameter without authentication.

Affected products

WPZOOM Connect up to 4.7.3

Timeline

2026-10-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.