CVE-2024-13646 is an improper authorization vulnerability classified under CWE-285 found in the Single-user-chat plugin for WordPress, affecting all versions up to 0.5. The vulnerability resides in the 'single_user_chat_update_login' function, which insufficiently validates the privileges of authenticated users attempting to update option values on the WordPress site. Specifically, users with subscriber-level access or higher can modify critical options such as 'login' values. This unauthorized modification can lead to denial of service by causing site errors or enabling/disabling features like user registration improperly. The vulnerability does not require user interaction beyond authentication and can be exploited remotely over the network (AV:N). The CVSS v3.1 base score is 8.1, reflecting high severity due to low attack complexity, no user interaction, and significant impact on integrity and availability. Although no public exploits are known, the flaw poses a serious risk to site stability and security. The plugin’s widespread use in WordPress environments makes this a relevant threat for many organizations relying on it for chat functionality.

The vulnerability allows attackers with minimal privileges (subscriber-level) to escalate their impact by modifying critical site options, potentially causing denial of service through site errors or misconfiguration. This can disrupt legitimate user access and degrade the availability of the WordPress site. Additionally, unauthorized changes to registration settings could lead to further security risks, such as unauthorized user registrations or disabling legitimate registrations, impacting site integrity and user management. Organizations relying on the Single-user-chat plugin may experience service outages, loss of user trust, and increased administrative overhead to recover from attacks. The ease of exploitation and the potential for widespread disruption make this a significant threat to WordPress sites using this plugin.

1. Immediately update the Single-user-chat plugin to a patched version once available from the vendor or plugin author. 2. Until a patch is released, restrict plugin usage to trusted users only and limit subscriber-level access where possible. 3. Implement strict role-based access controls (RBAC) to minimize the number of users with subscriber or higher privileges. 4. Monitor WordPress option changes and audit logs for unauthorized modifications, especially changes to critical options like 'login' and registration settings. 5. Employ Web Application Firewalls (WAFs) with custom rules to detect and block suspicious requests targeting the 'single_user_chat_update_login' function. 6. Regularly back up WordPress site configurations and databases to enable rapid recovery in case of denial of service or misconfiguration. 7. Educate site administrators about this vulnerability and encourage vigilance for unusual site behavior or errors that may indicate exploitation attempts.