Missing capability checks in Hive Support plugin allow authenticated users with Subscriber-level access and above to read or overwrite the site’s OpenAI API key, modify AI‑chat prompts, and alter inspection data. This can expose sensitive credentials and alter chatbot behavior, potentially leading to data exposure and unauthorized use of the OpenAI API.

The vulnerability affects the Hive Support WordPress plugin, versions up to and including 1.2.5. All installations of this plugin on a WordPress site, regardless of thematic environment, are potentially impacted unless the plugin has been upgraded past v1.2.5.

The CVSS score of 7.1 indicates a moderate to high severity, while the EPSS score of <1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with Subscriber or higher permissions, likely via AJAX calls to the hs_update_ai_chat_settings and hive_lite_support_get_all_binbox endpoints. No remote code execution is reported, but the attacker can gain persistent access to the site’s OpenAI credentials and alter chatbot behavior.