Read the docs

wppconnect

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

wppconnect records in CISA KEV

No wppconnect vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-84363 CVE-2026-121557 · GHSA-cj7j-h23p-3c8m

Missing authentication in WPPConnect Server allows sending messages

Priority LOW 36

WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00411 Published 2026-11-03 No fix listed CWE-306
TI-2026-85576 CVE-2026-123197 · GHSA-r9xw-h7vq-jh5r

Missing authentication exposes WPPConnect Server sticker media

Priority LOW 31

WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00415 Published 2026-11-05 No fix listed CWE-552
Open these records in search →