What is the CVSS score of CVE-2026-1253?

CVE-2026-1253 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1253?

Organizations using all should be aware of moderate risk from CVE-2026-1253, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-1253?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-1253

EUVD-2026-13983 MEDIUM

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-m7rf-c5vj-q364

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13983

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 4.3

DescriptionCVE.org

The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'atomchat_update_auth_ajax' and 'atomchat_update_layout_ajax' functions in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options, including critical settings such as API keys, authentication keys, and layout configurations.

AnalysisAI

The Group Chat & Video Chat by AtomChat WordPress plugin (versions up to 1.1.7) contains a missing capability check vulnerability in the 'atomchat_update_auth_ajax' and 'atomchat_update_layout_ajax' AJAX handlers, allowing authenticated Subscriber-level users and above to arbitrarily modify plugin options including API keys and authentication credentials. With a CVSS score of 5.3 and network-based attack vector requiring only authentication (not admin privileges), this represents a medium-severity privilege escalation and configuration tampering issue affecting WordPress installations using this plugin. No evidence of active exploitation in the wild has been documented at this time, though the straightforward nature of the vulnerability (missing capability checks) suggests proof-of-concept code could be easily developed.

Technical ContextAI

The vulnerability exists in the WordPress AJAX request handling layer within the atomchat_requesthandler.php file (confirmed at line 175 in both trunk and 1.1.7 tag via plugin repository references). The root cause is classified under CWE-862 (Missing Authorization), specifically a failure to implement proper WordPress capability checks (typically wp_verify_nonce and current_user_can checks) before processing AJAX callbacks that modify sensitive plugin options. WordPress AJAX handlers registered with add_action('wp_ajax_*') are accessible to any authenticated user by default; the plugin fails to restrict these handlers to administrator-level capabilities, instead allowing any authenticated user (including Subscribers) to invoke option-update functions. This represents a classic authorization bypass in the context of WordPress plugin development, where AJAX endpoints must explicitly validate user roles and capabilities before performing state-changing operations.

RemediationAI

Update the Group Chat & Video Chat by AtomChat plugin to a patched version beyond 1.1.7 if available from the plugin author; check the WordPress Plugin Directory or the plugin's official repository for the latest release. If no patched version is immediately available, temporary mitigation measures include: (1) restrict WordPress user roles to Administrator and Editor only, removing or disabling Subscriber accounts until a fix is released; (2) use a WordPress security plugin (e.g., Wordfence, Sucuri) to monitor and block suspicious AJAX requests to the atomchat_update_auth_ajax and atomchat_update_layout_ajax endpoints; (3) consider disabling the plugin entirely if it is non-critical to operations. Additionally, audit all plugin option changes in the WordPress admin panel and verify that API keys and authentication credentials have not been compromised. For full details, refer to the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/5c2980c3-0038-42ab-8751-72c40921477a?source=cve and monitor the plugin repository at https://plugins.trac.wordpress.org/browser/atomchat/ for patch releases.