Is WA Blaster safe?
WA Blaster embeds a reusable bearer token for its CRM lead-update API in the installed extension package.
The shipped main, content, and service-worker scripts include the same Authorization bearer token and use it when posting lead-update requests to an AWS API endpoint. The source also includes bypass code that forces Pro/broadcast-limit checks to pass while the extension operates on web.whatsapp.com.
Who publishes itThe Digitalify - 1 other listing from the same operator, none carrying a finding
The Digitalify - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 4 users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
WA Blaster disables paid-plan and broadcast safety controls.
Using WA Blaster on WhatsApp Web runs code that forces paid-plan and broadcast-limit checks to always pass, and reports broadcasts as completed regardless.
It reads page content and extension storage while sending via web.whatsapp.com.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
The user starts a WA Blaster send action on WhatsApp Web.
The extension makes paid-plan and broadcast-limit checks pass, reports completion, and continues the send flow through web.whatsapp.com.
- WhatsApp page contentWhatsApp Web chat and compose area (illustrative)
DOM content can include the active WhatsApp Web interface that the extension reads or controls while sending messages.
- Extension storage dataPlan and broadcast state values (illustrative)
Storage data can preserve extension state such as plan status, limits, or send-progress values used by the broadcast flow.
Observed during dynamic analysis, WA Blaster was confirmed to make its plan and broadcast-limit checks return as allowed while reporting broadcast progress as completed.
What it can do
Permissions this extension asks for, as declared in version 10.0.60. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on soletstalkapp.com
https://soletstalkapp.com/*
Read and change your data on www.soletstalkapp.com
https://www.soletstalkapp.com/*
Read and change your data on wasender.ai
https://wasender.ai/*
Read and change your data on www.wasender.ai
https://www.wasender.ai/*
Store data in your browser
storage
Read and change cookies, including the ones that keep you signed in
cookies
Where it sends data
Destinations our analysis observed WA Blaster contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- web.whatsapp.com
WA Blaster sends data to web.whatsapp.com. 7 other extensions we have analysed send data here.
- 022os10kr2.execute-api.ap-south-1.amazonaws.com
WA Blaster sends data to 022os10kr2.execute-api.ap-south-1.amazonaws.com. No other extension we have analysed sends data here.