CVE-2025-53200

The ChatBot plugin for WordPress suffers from a missing authorization vulnerability. This means that certain functions or endpoints do not properly verify user permissions, allowing unauthorized access. The issue stems from incorrectly configured access control security levels [1].

An attacker can exploit this by sending crafted requests to the vulnerable plugin without needing authentication. The attack surface includes WordPress admin areas or AJAX actions that lack proper capability checks. No special network position is required; the attacker only needs to be able to reach the WordPress site [1].

Successful exploitation could allow an unprivileged user to perform actions that should require higher privileges, such as modifying chatbot settings or accessing sensitive data. The CVSS score is 4.3 (Medium), indicating a moderate severity [1].

The vulnerability has been patched in version 6.7.5. Users are advised to update immediately. For those unable to update, consulting a hosting provider or developer for assistance is recommended [1].