The Hive Support plugin for WordPress suffers from missing capability checks in the hs_update_ai_chat_settings() and hive_lite_support_get_all_binbox() functions in all versions up to 1.2.5. This authorization bypass allows authenticated users with low privileges (Subscriber-level and above) to read and overwrite sensitive configuration data such as the OpenAI API key and AI chat prompts. The vulnerability is categorized under CWE-862 (Missing Authorization) and has a CVSS 3.1 score of 7.1 (High), indicating network attack vector, low attack complexity, privileges required, no user interaction, with high confidentiality impact and low integrity impact.

An attacker with Subscriber-level access can gain unauthorized read and write access to sensitive plugin data, including the OpenAI API key and AI chat configuration. This could lead to exposure of confidential credentials and manipulation of AI chatbot behavior, potentially undermining the integrity of AI-driven interactions. There is no reported impact on system availability. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to the Hive Support plugin. Avoid granting Subscriber-level or higher access to untrusted users. Review and rotate any exposed API keys if compromise is suspected.