CVE-2026-1253 describes a missing authorization vulnerability in the Group Chat & Video Chat by AtomChat WordPress plugin. The flaw exists in the 'atomchat_update_auth_ajax' and 'atomchat_update_layout_ajax' functions, which lack proper capability checks. This allows authenticated users with low privileges (Subscriber-level and above) to update sensitive plugin options, including API and authentication keys as well as layout settings. The vulnerability affects all versions up to and including 1.1.7. The CVSS 3.1 base score is 4.3 (medium severity), reflecting the network attack vector, low attack complexity, and limited impact on integrity without confidentiality or availability impact. No known exploits in the wild or vendor patches are documented in the provided information.

An attacker with Subscriber-level access or higher can modify critical plugin settings, potentially compromising the integrity of the plugin's configuration. This could lead to unauthorized changes in API keys and authentication credentials, which may affect the security posture of the affected WordPress site. However, there is no direct confidentiality or availability impact reported. The medium severity score reflects the limited scope of the impact but acknowledges the risk of unauthorized configuration changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for unauthorized changes to plugin settings. Avoid granting unnecessary privileges to low-level authenticated users. Review plugin configurations regularly to detect unauthorized modifications.