MEDIUM
WSChat – WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
Published Nov 19, 2025
4.3
MEDIUMCVSS 3.1
EPSS 0.19%
Description
The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'reset_settings' AJAX endpoint in all versions up to, and including, 3.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings.
Affected products
-
- Version -StatusaffectedConstraints<=3.1.6
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Elextensions | WSChat – WordPress Live Chat | unaffected |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198114 Advisory
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3395773%40wschat-live-chat&new=3395773%40wschat-live-chat&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0be6658d-aec8-404c-a994-bde10a3cdbac?source=cve
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Wordfence
Published Nov 19, 2025
Updated Apr 8, 2026
Reserved Nov 5, 2025
Link CVE-2025-12751
CISA Vulnrichment
Updated Nov 19, 2025
ENISA EUVD
EUVD-2025-198114 Assigner Wordfence
Published Nov 19, 2025
Updated Apr 8, 2026
Exploited since n/a
Link EUVD-2025-198114