The Chat by Chatwee plugin for WordPress versions up to 2.1.3 suffers from a missing or incorrect nonce check on the admin settings page, which allows an unauthenticated attacker to modify plugin settings if they can trick a site administrator into clicking a link. The attacker could change configuration options to their advantage or create a stepping‑stone for further exploitation, although the vulnerability itself does not allow direct code execution.

This issue applies to the WordPress Chat by Chatwee plugin version 2.1.3 and all earlier releases. Administrators who have installed any of those plugin versions on their sites are affected.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires social engineering – the attacker must lure an administrator into submitting a forged request, so the risk is largely dependent on the likelihood of such a social‑engineering attack.