Executive brief
The Social Contact Form (FormyChat) WordPress plugin contains a flaw that allows unauthenticated visitors to read submitted form entries from Gravity Forms without any permission checks. An attacker can request a public web endpoint and retrieve sensitive information such as names, email addresses, and phone numbers that users submitted through contact forms on the site.
Technical details
The plugin registers a public AJAX action (formychat_get_gf_entry) that retrieves Gravity Forms entries without performing any authentication, authorization, or nonce validation. An unauthenticated attacker can send a simple HTTP GET request to wp-admin/admin-ajax.php with the action parameter and a form ID to retrieve the most recent entry for that form, including all field values mapped by label. By incrementing the form ID, an attacker can enumerate and extract entries from multiple forms. The vulnerability requires Gravity Forms to be active and at least one form entry to exist, but the form does not need to be connected to the FormyChat plugin. The issue was patched in version 2.15.8.
Affected products
- FormyChat Social Contact Form before 2.15.8
Timeline
- 2026-09-11: disclosed
- 2026-09-13: patched: Fixed in version 2.15.8