One to one user Chat by WPGuppy

One to one user Chat by WPGuppy has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 6 are fixed as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2025 was the busiest year with 5 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (17%). Other recurring categories include Deserialization Of Untrusted Data, Incorrect Privilege Assignment.

Every one of the 6 issues recorded for One to one user Chat by WPGuppy has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (2) reported by I8BL.

Strategic Overview

Avg CVSSMedium

6.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all One to one user Chat by WPGuppy vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-49222

WPGuppy <= 1.1.0 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

6 records


2026-02-13 18:16	One to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interception One to one user Chat by WPGuppy <= 1.1.4	`CVE-2025-6792`	5.3 Medium	Jonas Benjamin Friedli	Yes
2025-08-14 00:00	WPGuppy <= 1.1.4 - Missing Authorization One to one user Chat by WPGuppy <= 1.1.4	`CVE-2025-49910`	5.3 Medium	Nabil Irawan	Yes
2025-03-27 00:00	WPGuppy <= 1.1.3 - Authenticated (Subscriber+) SQL Injection One to one user Chat by WPGuppy <= 1.1.3	`CVE-2025-30775`	6.5 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2025-01-09 00:00	One to one user Chat by WPGuppy <= 1.1.0 - Authorization Bypass One to one user Chat by WPGuppy <= 1.1.0	`CVE-2025-24643`	5.3 Medium	l8BL	Yes
2025-01-03 00:00	WPGuppy <= 1.1.0 - Authenticated (Subscriber+) Privilege Escalation One to one user Chat by WPGuppy <= 1.1.0	`CVE-2024-56280`	8.8 High	I8BL	Yes
2025-01-03 00:00	WPGuppy <= 1.1.0 - Unauthenticated PHP Object Injection One to one user Chat by WPGuppy <= 1.1.0	`CVE-2024-49222`	9.8 Critical	I8BL	Yes

Showing 1–6 of 6 reports