The vendor Chatbox Manager plugin contains a missing authorization flaw that permits users to bypass access controls when interacting with the plugin’s administrative interfaces. This broken access control can allow an attacker to modify plug‑in settings, inject content, or otherwise manipulate the WordPress site without proper privileges, matching CWE‑862. The vulnerability is present in all releases up to version 1.2.5 and does not affect later versions.

The flaw specifically targets the alexvtn Chatbox Manager WordPress plugin version 1.2.5 and earlier. Any site that has installed this plugin and has it active, especially with user roles that have elevated permissions such as Editors or Contributors, may be vulnerable. No other products or vendors are listed.

The CVSS score of 5.4 classifies the issue as a moderate risk. The EPSS score is below 1 %, indicating a low likelihood of mass exploitation at present, and the vulnerability is not in CISA’s KEV catalog. Attackers would target the plugin’s administrative endpoints, and while the flaw does not allow arbitrary code execution, it provides a non‑trivial privilege escalation path for anyone who can reach those interfaces. The impact could compromise site configuration and displayed content.