Skip to main content

[Privacy Bug - GDPR concern] Chat search exposes all user profiles regardless of privacy settings

I noticed that the user search function inside the Chat feature allows any member to look up and list all community users: even when "Only allow moderators and admins to initiate chats" is enabled.

Steps to reproduce:

  1. Set chat permissions to "Only moderators and admins can initiate chats"
  2. Set all profile visibility options to private
  3. Have the community set to private
  4. Log in as a regular member
  5. Open the Chat section and use the search bar
  6. All user profiles are searchable and visible

Expected behavior: Regular members should not be able to search or list other users if chat initiation is restricted and profile visibility is set to private.

This is especially concerning for communities with strict privacy requirements.In the case of private communities, and after the latest GDPR-related update I configured all profile visibility settings to private as well. Despite this, the chat search still exposes the full member list if you use the search bar.

This feels like an oversight: the chat search doesn't seem to respect the privacy/visibility settings applied elsewhere.

Thanks for looking into it!

cc: issue related to Gee AdriaanszΒ 's post : https://community.wpmanageninja.com/portal/space/community-meta/post/privacy-issue-with-profiles

If someone can check this on their side too...

[Privacy Bug - GDPR concern] Chat search exposes all user profiles regardless of privacy settings

JF

+1

Shahjahan Jewel

We are looking into this.

Shahjahan Jewel

Hi Jorge de los ReyesΒ we have fixed the issue in our dev branch already and we will release this fix in the next version. Hopefully within next few days.

Shahjahan JewelΒ Thank you Jewel! Superfast fix! :)

Owen Kane

Many thanks for the continued effort.