Is Global Gym Software SMS Sender safe?

Medium risk

Global Gym Software SMS Sender sends the WhatsApp login number and account email to wpsender.globalcrm.in when a batch starts.

When a user starts a WhatsApp person-sending batch, the extension reads the WhatsApp account number from WhatsApp Web and saves it in extension storage. It then posts that number, the stored account email or login identity, and a login source label to wpsender.globalcrm.in.

Global Gym Softwarev5.2.9Chrome Web Store
46Risk
Who publishes it

Global Gym Software - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Global Gym Software
Declared legal entity
Global Gym Software
Registered address
Anand, ANAND, ANAND, Gujarat 388001, IN
Registered contact
Pradeep Rajput
Website
googledataextractor.co.in/

Same store account

1 other listing published from this account, 20k+ users between them. 1 of them carries a finding.

Global Gym Software20k+High

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WhatsApp send batches report account and login identity.

When you start a WhatsApp person-sending batch, the extension sends the WhatsApp account number and stored login identity to wpsender.globalcrm.in.

These fields come from extension storage and form input tied to the batch workflow.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user starts a WhatsApp person-sending batch.

The extension did this

The extension sends the WhatsApp account number and login identity to wpsender.globalcrm.in.

Captured request
POSThttps://wpsender.globalcrm.in/api/save_login_history.php
Fields in the request
  • Stored WhatsApp account data
    +15551234567 (illustrative)

    This links the batch activity to the WhatsApp account number saved by the extension.

  • Login form identity
    user@example.com (illustrative)

    This identifies the extension login or email associated with the batch action.

Observation

Observed during dynamic analysis: the request included login_number, email_id, and login_source when the user-started send workflow began.

What it can do

Permissions this extension asks for, as declared in version 5.2.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on wpsender.globalcrm.in

    https://wpsender.globalcrm.in/api/*

  • See the address and title of every tab you have open

    tabs

  • Start, monitor and manage your downloads

    downloads

  • Show you desktop notifications

    notifications

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

Where it sends data

Destinations our analysis observed Global Gym Software SMS Sender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • wpsender.globalcrm.in

    Global Gym Software SMS Sender sends data to wpsender.globalcrm.in. No other extension we have analysed sends data here.

Updated 30 September 2026kijanlfooapbndmckekcebgjpobpgiea