The Essential Chat Support plugin fails to verify user authorization when processing the ecs_reset_settings parameter. An attacker who can send a POST request with ecs_reset_settings=1 can reset every plugin configuration—including general settings, display rules, custom CSS, and WooCommerce tab settings—to default values. This constitutes an authorization bypass (CWE‑862) that allows an unauthenticated user to alter operational configuration, potentially disrupting service or compromising the intended configuration of the site.

All WordPress sites running Essential Chat Support version 1.0.1 or earlier are affected. The plugin is distributed under the essentialplugin:Essential Chat Support label and is commonly deployed through the WordPress plugin repository.

The impact has a CVSS score of 5.3, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires only the ability to send a crafted POST request to a publicly accessible WordPress site and does not depend on authenticated credentials or additional privileges. Consequently, the risk is considered moderate, with attackers able to easily manipulate configuration settings without restriction.