EUVD-2026-13983
GHSA-m7rf-c5vj-q364
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'atomchat_update_auth_ajax' and 'atomchat_update_layout_ajax' functions in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options, including critical settings such as API keys, authentication keys, and layout configurations.
AnalysisAI
The Group Chat & Video Chat by AtomChat WordPress plugin (versions up to 1.1.7) contains a missing capability check vulnerability in the 'atomchat_update_auth_ajax' and 'atomchat_update_layout_ajax' AJAX handlers, allowing authenticated Subscriber-level users and above to arbitrarily modify plugin options including API keys and authentication credentials. With a CVSS score of 5.3 and network-based attack vector requiring only authentication (not admin privileges), this represents a medium-severity privilege escalation and configuration tampering issue affecting WordPress installations using this plugin. No evidence of active exploitation in the wild has been documented at this time, though the straightforward nature of the vulnerability (missing capability checks) suggests proof-of-concept code could be easily developed.
Technical ContextAI
The vulnerability exists in the WordPress AJAX request handling layer within the atomchat_requesthandler.php file (confirmed at line 175 in both trunk and 1.1.7 tag via plugin repository references). The root cause is classified under CWE-862 (Missing Authorization), specifically a failure to implement proper WordPress capability checks (typically wp_verify_nonce and current_user_can checks) before processing AJAX callbacks that modify sensitive plugin options. WordPress AJAX handlers registered with add_action('wp_ajax_*') are accessible to any authenticated user by default; the plugin fails to restrict these handlers to administrator-level capabilities, instead allowing any authenticated user (including Subscribers) to invoke option-update functions. This represents a classic authorization bypass in the context of WordPress plugin development, where AJAX endpoints must explicitly validate user roles and capabilities before performing state-changing operations.
RemediationAI
Update the Group Chat & Video Chat by AtomChat plugin to a patched version beyond 1.1.7 if available from the plugin author; check the WordPress Plugin Directory or the plugin's official repository for the latest release. If no patched version is immediately available, temporary mitigation measures include: (1) restrict WordPress user roles to Administrator and Editor only, removing or disabling Subscriber accounts until a fix is released; (2) use a WordPress security plugin (e.g., Wordfence, Sucuri) to monitor and block suspicious AJAX requests to the atomchat_update_auth_ajax and atomchat_update_layout_ajax endpoints; (3) consider disabling the plugin entirely if it is non-critical to operations. Additionally, audit all plugin option changes in the WordPress admin panel and verify that API keys and authentication credentials have not been compromised. For full details, refer to the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/5c2980c3-0038-42ab-8751-72c40921477a?source=cve and monitor the plugin repository at https://plugins.trac.wordpress.org/browser/atomchat/ for patch releases.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today