The vulnerability allows an attacker who is not logged into the WordPress site to overwrite the MobileMonkey API token and company ID stored by the WP-Chatbot for Messenger plugin. By doing so, the attacker can hijack the chatbot configuration and redirect visitor conversations to a malicious MobileMonkey account. The flaw stems from the plugin failing to confirm that the requester has sufficient privileges before performing the token update, a classic authorization bypass as defined by CWE-862.

All installations of WP-Chatbot for Messenger version 4.9 and earlier on WordPress sites are affected. The vendor responsible is Larry Kim. Sites that have not applied an update beyond version 4.9 are at risk; the specific configuration parameters that can be overwritten are the MobileMonkey API token and the company ID.

The CVSS score of 5.3 indicates a medium risk level, and because the exploit requires no technical barriers beyond sending a crafted request, the vulnerability can be triggered by any unauthenticated user with network access to the site. Although no EPSS score is available, the lack of any requirement for privileged access means the likelihood of exploitation is uncertain but potentially high in environments where the plugin is exposed. The vulnerability has not been reported in the CISA KEV catalog, implying no public evidence of exploitation to date.