Wise Chat EUVD-2026-93252

Requires an authenticated WordPress account at Subscriber role or higher on a site running Wise Chat plugin version 3.4.1 or earlier (PR:L in the CVSS vector confirms low-privilege authentication is needed - this is not remote-unauthenticated). The practical prerequisite is that the target site permits user self-registration (open Subscriber signup) or that the attacker already holds a basic account; sites that disable registration and have no untrusted low-privilege users are not realistically exploitable by anonymous outsiders. Exploitation requires no user interaction (UI:N) and no victim admin involvement. The limiting factors are therefore the need for a valid low-privilege credential and the presence of the vulnerable plugin version; the specific feature/endpoint lacking the capability check is not named in the available data.

This is a moderate-severity authorization flaw (CWE-862, Missing Authorization) in the Wise Chat WordPress plugin, rated CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. The network attack vector and low complexity make it technically easy to reach, but PR:L means a valid low-privilege (Subscriber-level) WordPress account is required, which meaningfully constrains exploitation to sites that allow user registration or where the attacker already holds a basic account. The impact profile is unusual: no confidentiality loss (C:N), only limited integrity impact (I:L), but HIGH availability impact (A:H) - the 7.1 score is driven primarily by the availability component rather than data compromise. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a credible-but-not-urgent patch-management item rather than an actively weaponized threat. The main unknowns are the specific vulnerable endpoint/action and precisely what a Subscriber can disrupt - the description is a one-line summary from Patchstack and does not enumerate the affected functionality, so the A:H rating should be verified against the vendor/Patchstack advisory before treating availability impact as confirmed.

An attacker registers or uses an existing low-privilege Subscriber account on a WordPress site running Wise Chat <= 3.4.1, then invokes a plugin action that lacks a proper authorization (capability) check. Because the endpoint is network-reachable and requires no user interaction, the authenticated Subscriber can perform an operation they should not be permitted to, degrading the availability of the chat functionality or related data. No public proof-of-concept was identified in the provided intelligence.