The vulnerability is an Authorization Bypass Through User‑Controlled Key (IDOR) in the Themeisle AI Chatbot for WordPress – Hyve Lite plugin. Incorrectly configured access control security levels allow an attacker who can supply a user‑controlled key to view or modify data that should be restricted to the owning user or higher privilege level.

Themeisle AI Chatbot for WordPress – Hyve Lite plugin, with any version up to and including 2.0.2. Versions released after 2.0.2 contain the patch. There is no indication that other plugins or WordPress core files are affected.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, so the likelihood of exploitation cannot be quantified from the public data, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access through the web interface, requiring an authenticated session. An attacker who has gained some level of access or is a legitimate user can manipulate the plugin’s internal identifiers to retrieve or change records that belong to other users. If the plugin is enabled on a site with many authenticated customers, the exposure could result in data disclosure or unauthorized data manipulation. Because no public exploit is reported, the immediate risk is primarily theoretical, but the missing access control still poses a real threat if intruders establish a foothold.