CVE-2024-13646CWE-285

Single-user-chat <= 0.5 - Authenticated (Subscriber+) Limited Options Update

High · published January 30, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the 'single_user_chat_update_login' function in all versions up to, and including, 0.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update option values to 'login' on the WordPress site. This may be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00374 · 30.2th percentile
Weakness
CWE-285 · Improper Authorization
Published
2025-01-30T13:42Z
EPSS history
Timeline
  • 30 JAN 13:42Z
    Single-user-chat <= 0.5 - Authenticated (Subscriber+) Limited Options Update
    cvelistv5