CVE-2024-10533 is a missing authorization vulnerability in the WP Chat App plugin for WordPress, affecting all versions up to and including 3.6.8. The ajax_install_plugin() function lacks proper capability checks, enabling authenticated users with low privileges (Subscriber-level and above) to install the filebird plugin or potentially other plugins. This improper authorization can lead to unauthorized plugin installation, which may impact the integrity of the WordPress environment. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows authenticated users with Subscriber-level access or higher to install plugins without authorization. This could lead to unauthorized modification of the WordPress site by installing additional plugins, potentially escalating privileges or introducing malicious functionality. However, the impact is limited to integrity and does not affect confidentiality or availability according to the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor plugin installation activity. Avoid granting unnecessary privileges to low-level authenticated users. Follow updates from the ninjateam vendor for an official patch or mitigation instructions.