Is WADirect Message safe?
WADirect Message sends links in WhatsApp messages to third-party link-preview services before delivery.
When you send a WhatsApp message through WADirect Message, the extension passes your message into WhatsApp's send flow with link previews enabled. If the message contains a URL, the bundled library requests preview data from external link-preview services using the encoded URL, and may request thumbnail images the same way.
Who publishes itHenckel Dev - 3 other listings from the same operator, none carrying a finding
Henckel Dev - 3 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 5k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
WhatsApp message links are sent to external preview services before delivery
When you send a WhatsApp message with a link via WADirect Message, its link-preview flow sends the encoded URL to external preview services before delivery, along with the form-entered message content.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You use the extension to send a WhatsApp message that contains a link.
The extension's link-preview flow forwards the message URL to external preview services before delivery.
- Message textPlease review https://example.com/invoice (illustrative)
The typed WhatsApp message can include surrounding text that explains why the link is being sent.
- Link in the messagehttps://example.com/invoice (illustrative)
The URL can reveal the page or resource being shared with the recipient.
Where it sends data
Destinations our analysis observed WADirect Message contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- wajsapi.titanchat.com.br
WADirect Message sends data to wajsapi.titanchat.com.br. 12 other extensions we have analysed send data here.
- wppc-linkpreview.cloudtrix.com.br
WADirect Message sends data to wppc-linkpreview.cloudtrix.com.br. 12 other extensions we have analysed send data here.
- cobrancas.uppermesh.com.br:8000
WADirect Message sends data to cobrancas.uppermesh.com.br:8000. 2 other extensions we have analysed send data here.