Hyve Lite EUVD-2026-92586

Exploitation requires the Hyve Lite plugin (versions up to and including 2.0.2) to be installed and active on a reachable WordPress site, and the attacker must invoke the affected object-referencing feature while supplying a user-controlled identifier (the direct object reference) for a resource they do not own. Per PR:N/UI:N, no authentication or user interaction is needed. The principal LIMITING factor is impact scope: only a Low integrity effect is possible (VC:N/VA:N), so the attacker cannot read confidential data or disrupt availability through this flaw; realistic risk is confined to unauthorized modification of chatbot-related records.

This is a moderate-severity authorization bypass (IDOR, CWE-639) in the Themeisle Hyve Lite WordPress AI chatbot plugin, scored CVSS 4.0 6.9. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction - signals that normally raise priority. However, the impact is deliberately narrow: only integrity is affected and only at a Low level (VI:L), with no confidentiality (VC:N) and no availability (VA:N) impact, and no scope change to subsequent systems. There is no EPSS score provided, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The sole intelligence source is Patchstack. In short, the easy-to-reach unauthenticated vector keeps this above trivial, but the limited integrity-only impact and absence of any exploitation or POC evidence mean this is a 'patch in normal cadence' issue rather than an emergency - the high reachability is counterbalanced by low technical impact.

An unauthenticated remote attacker sends crafted requests to the Hyve Lite plugin endpoint, substituting an object identifier (a user-controlled key) to reference records belonging to other users or contexts they should not be able to modify. Because the plugin incorrectly validates access-control levels, the attacker achieves a limited integrity impact such as altering or injecting chatbot-related data. No public POC is referenced, and the integrity impact is rated Low, limiting the blast radius.