CVE-2025-12751 is a missing authorization vulnerability (CWE-862) in the WSChat – WordPress Live Chat plugin for WordPress. The issue arises because the 'reset_settings' AJAX endpoint does not perform a capability check, enabling authenticated users with low privileges (Subscriber-level and above) to reset plugin settings. This could lead to unauthorized modification of plugin configuration. The vulnerability affects all versions up to and including 3.1.6. The CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting that the attack requires network access and low privileges but results only in integrity impact without confidentiality or availability loss.

An attacker with authenticated access at Subscriber level or higher can reset the WSChat plugin settings without authorization. This unauthorized modification could disrupt plugin functionality or reset configurations to default, potentially affecting chat availability or behavior. There is no direct confidentiality or availability impact reported. No known active exploits have been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals and monitor for unauthorized changes to plugin settings. Consider disabling or limiting access to the affected AJAX endpoint if feasible.