CVE-2025-48167

The Chatbox Manager plugin (wa-chatbox-manager) for WordPress versions up to and including 1.2.5 suffers from a broken access control vulnerability. The root cause is missing authorization checks, meaning the plugin does not properly verify that a user has the necessary privileges before allowing certain actions [1].

Exploitation is possible without authentication or with low-level privileges, making it easy for attackers to trigger higher-privileged operations. The attack surface is broad, as the plugin is widely used, and such flaws are often targeted in mass-exploit campaigns against thousands of sites regardless of their popularity [1].

An attacker exploiting this vulnerability could gain unauthorized access to administrative functions or sensitive data, potentially leading to defacement, data theft, or further compromise of the WordPress site. The severity is rated medium (CVSS 5.4) [1].

Mitigation is straightforward: update to version 1.2.6 or later, which includes a fix for the missing authorization. Patchstack users can enable auto-updates. No workaround details are provided beyond updating [1].