Wordpress Plugin
CVE-2025-48167
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chatbox Manager: from n/a through <= 1.2.5.
AnalysisAI
Missing authorization controls in Chatbox Manager WordPress plugin versions 1.2.5 and earlier allow unauthenticated or low-privileged attackers to bypass access control restrictions and exploit incorrectly configured security levels. The vulnerability stems from improper implementation of role-based access checks, potentially enabling unauthorized users to access or modify sensitive chatbox functionality. With an EPSS score of 0.05% and no evidence of active exploitation, this is a lower-priority vulnerability suitable for routine patching cycles.
Technical ContextAI
This vulnerability is classified as CWE-862 (Missing Authorization), which occurs when a software system fails to properly validate user permissions before granting access to protected resources or operations. In the context of the Chatbox Manager WordPress plugin, the vulnerability likely involves missing capability checks in WordPress hook handlers or API endpoints that should restrict certain administrative or sensitive functions. The plugin architecture probably lacks proper nonce verification, role validation via current_user_can(), or similar WordPress permission enforcement mechanisms. WordPress plugins typically implement access control through capability checks tied to user roles (subscriber, contributor, author, editor, administrator); this vulnerability indicates that one or more functions bypass these checks entirely or apply them inconsistently across different security levels.
Affected ProductsAI
Chatbox Manager plugin by alexvtn (identified via CPE reference wa-chatbox-manager) is affected in all versions from initial release through and including version 1.2.5. The plugin is distributed via WordPress.org plugin repository and is typically installed on WordPress sites running PHP and WordPress core. Patchstack's vulnerability database (https://patchstack.com/database/Wordpress/Plugin/wa-chatbox-manager/vulnerability/wordpress-chatbox-manager-plugin-1-2-5-broken-access-control-vulnerability) provides the authoritative affected version range and advisory details.
RemediationAI
Update Chatbox Manager plugin to a version newer than 1.2.5 as soon as a patched release is made available by the plugin author; check the official WordPress plugin repository or the vendor's GitHub repository for the latest stable version. In the interim, if the plugin is not actively used or if chatbox functionality is not critical, consider temporarily deactivating the plugin to eliminate exposure. Site administrators should verify that WordPress user roles and capabilities are correctly configured, ensuring that only intended users (typically administrators or support staff) can access or modify chatbox settings; review user role assignments and consider restricting plugin access via capability management plugins if granular control is needed. Monitor the Patchstack advisory link (https://patchstack.com/database/Wordpress/Plugin/wa-chatbox-manager/vulnerability/wordpress-chatbox-manager-plugin-1-2-5-broken-access-control-vulnerability) for patch release notifications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today