The Xelion Webchat plugin for WordPress contains a missing capability check in the xwc_save_settings() function that allows any authenticated user with Subscriber or higher privileges to modify arbitrary options on the site. This flaw can lead to privilege escalation, for example by changing the default role for registration to administrator or enabling user registration for attackers to create new administrator accounts. The weakness is categorized as CWE‑862, indicating an inadequate authorization check.

WordPress sites using the Xelion Webchat plugin version 9.1.0 or earlier are affected. All installations of the plugin within this version range must be reviewed for potential exploitation.

The vulnerability has a CVSS score of 8.8, reflecting a high severity, yet the EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires legitimate authentication, typically by a Subscriber or higher, and operates via the Ajax admin endpoint that should have a capability check. Once exploited, an attacker can alter critical site options and gain administrator-level access, posing a significant confidentiality, integrity, and availability risk if left unpatched.