This vulnerability arises from an incorrect assignment of user privileges within the Jauhari Xelion Webchat plugin. A flaw in the plugin’s internal role checks allows a user to obtain a higher level of access than intended. The effect is a privilege escalation that can potentially grant a user administrator‑like capabilities on a WordPress site, enabling full control over content, configuration, and user accounts.

The vulnerability affects all releases of the Xelion Webchat plugin up to and including version 9.1.0. WordPress sites that have installed the plugin, which provides real‑time chat functionality, are impacted. Site administrators should verify the plugin version and apply a fix if available.

The CVSS base score of 8.8 reflects high severity for privilege escalation. The EPSS score of less than 1 % indicates that widescale exploitation is unlikely at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers who can authenticate to the WordPress site, or who can access the plugin’s web interfaces, may exploit the flaw to elevate privileges. Because the issue is tied to the plugin’s privilege‑assignment logic, an attacker does not need pre‑existing admin rights to trigger the escalation.