The Autochat Automatic Conversation plugin for WordPress is vulnerable because the wp_ajax_nopriv_auycht_saveCid endpoint lacks a capability check. This missing authorization allows any unauthenticated user to send requests that modify the plugin’s client ID, effectively enabling the attacker to connect or disconnect the client from the conversation system. The flaw does not provide direct remote code execution, but it compromises the integrity of the plugin’s configuration and can alter user experience or data flow.

WordPress sites that have the Autochat Automatic Conversation plugin installed, versions 1.1.9 and earlier, regardless of site role or user authentication state.

The CVSS structure of 5.3 indicates moderate impact when exploited. However, the EPSS score of less than 1% reflects a very low likelihood of active exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would simply craft unauthenticated HTTP POST requests to the vulnerable AJAX endpoint, requiring no credentials and minimal effort. Given the lack of an authentication requirement, the vulnerability is readily exploitable as long as the plugin remains installed in a WordPress environment.