The AtomChat Group Chat & Video Chat plugin for WordPress allows authenticated users with Subscriber-level access or higher to modify plugin options via the atomchat_update_auth_ajax and atomchat_update_layout_ajax AJAX handlers. The vulnerability results from a missing capability check, enabling unauthorized modification of critical settings such as API keys, authentication credentials, and layout configurations. This capability can compromise the confidentiality of credentials, alter user experience, and potentially create a foothold for further attacks.

WordPress sites that have installed the AtomChat Group Chat & Video Chat plugin version 1.1.7 or any earlier release are affected. The issue applies to all versions up to and including 1.1.7, regardless of other plugin or theme components. Sites running newer releases beyond 1.1.7 are presumed to have the fix.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score below 1% suggests a low probability of exploitation. Because the attacker only needs an authenticated Subscriber account—a role commonly granted— the potential for exploitation exists on sites with vulnerable users. No publicly known exploits are reported, and the vulnerability is not listed in CISA's KEV catalog, but the limitations in authorization still require timely remediation to avoid configuration tampering.