The Kognetiks Chatbot for WordPress plugin suffers from a missing capability check in the delete_assistant() function in all versions up to and including 2.1.7. This authorization bypass vulnerability enables authenticated users with subscriber-level privileges or above to delete GPT assistants, potentially disrupting chatbot functionality. The vulnerability is tracked as CVE-2024-10529 and categorized under CWE-862. The CVSS 3.1 score of 5.3 reflects a network attack vector with low complexity and no user interaction required, but limited impact confined to integrity (unauthorized deletion). No patch or official remediation guidance has been published yet.

An attacker with subscriber-level access or higher can delete GPT assistants managed by the plugin, leading to unauthorized modification of chatbot data. This could disrupt chatbot operations or cause loss of assistant configurations. There is no indication of confidentiality or availability impact. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access to trusted users only to reduce risk. Monitor plugin updates from kognetiks for a security patch addressing this missing authorization issue.