CVE-2024-13646 is an improper authorization vulnerability (CWE-285) in the Single-user-chat WordPress plugin by aakashbhagat23. The flaw exists in the 'single_user_chat_update_login' function, allowing authenticated users with subscriber or higher privileges to update certain option values improperly. This can lead to denial of service by causing site errors or enabling unintended settings such as registration flags. The vulnerability affects all versions up to and including 0.5. There is no vendor-provided patch or advisory indicating remediation status. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, required privileges at the level of a subscriber, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

Exploitation allows authenticated users with subscriber or higher privileges to modify site option values improperly, potentially causing denial of service through site errors or misconfiguration. There is no impact on confidentiality. The integrity and availability of the WordPress site are affected. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities if possible or monitor for suspicious changes to site options related to login. Consider disabling or removing the Single-user-chat plugin if it is not essential.