Wpguppy Lite Vulnerabilities

The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/guppylite/v2/channel-authorize rest endpoint in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to intercept and view pri...

CVSS:

5.3

Affected:

up to 1.1.4

Fix:

No patched version reported

Disclosed:

Feb 13, 2026

CVE-2025-6792 on NVD →

[en] Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPGuppy: from n/a through <= 1.1.4.

Affected:

up to 1.1.4

Fix:

No patched version reported

Disclosed:

Oct 22, 2025

CVE-2025-49910 on NVD →

The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.1.4

Fixed in:

1.1.5

Disclosed:

Aug 14, 2025

CVE-2025-49910 on NVD →

The WPGuppy plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

CVSS:

6.5

Affected:

up to 1.1.3

Fixed in:

1.1.4

Disclosed:

Mar 27, 2025

CVE-2025-30775 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Private Limited WPGuppy allows SQL Injection. This issue affects WPGuppy: from n/a through 1.1.3.

Affected:

up to 1.1.4

Fixed in:

1.1.4

Disclosed:

Mar 27, 2025

CVE-2025-30775 on NVD →

[en] Missing Authorization vulnerability in Amento Tech Pvt ltd WPGuppy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPGuppy: from n/a through 1.1.0.

Affected:

up to 1.1.1

Fixed in:

1.1.1

Disclosed:

Feb 3, 2025

CVE-2025-24643 on NVD →

The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.0. This is due to the plugin not properly verifying a user's identity prior to using wp_set_current_user(). This makes it possible for unauthenticated attackers to spoof other users a...

CVSS:

5.3

Affected:

up to 1.1.0

Fixed in:

1.1.1

Disclosed:

Jan 9, 2025

CVE-2025-24643 on NVD →

[en] Deserialization of Untrusted Data vulnerability in Amento Tech Pvt ltd WPGuppy allows Object Injection.This issue affects WPGuppy: from n/a through 1.1.0.

Affected:

up to 1.1.1

Fixed in:

1.1.1

Disclosed:

Jan 7, 2025

CVE-2024-49222 on NVD →

[en] Incorrect Privilege Assignment vulnerability in Amento Tech Pvt ltd WPGuppy allows Privilege Escalation.This issue affects WPGuppy: from n/a through 1.1.0.

Affected:

up to 1.1.1

Fixed in:

1.1.1

Disclosed:

Jan 7, 2025

CVE-2024-56280 on NVD →

The WPGuppy plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.1.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an a...

CVSS:

9.8

Affected:

up to 1.1.0

Fixed in:

1.1.1

Disclosed:

Jan 3, 2025

CVE-2024-49222 on NVD →

The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.

CVSS:

8.8

Affected:

up to 1.1.0

Fixed in:

1.1.1

Disclosed:

Jan 3, 2025

CVE-2024-56280 on NVD →