The WP-Chatbot for Messenger plugin for WordPress contains a missing authorization check (CWE-862) in all versions up to and including 4.9. This flaw permits unauthenticated attackers to overwrite critical configuration options related to the MobileMonkey API token and company ID. Exploitation enables attackers to hijack chatbot configurations and redirect user conversations to attacker-controlled accounts. The vulnerability is network exploitable without privileges or user interaction, impacting integrity but not confidentiality or availability.

An attacker can overwrite the MobileMonkey API token and company ID options without authentication, allowing them to hijack chatbot configurations. This compromises the integrity of chatbot interactions by redirecting visitor conversations to attacker-controlled MobileMonkey accounts. There is no direct impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor for updates from the plugin vendor. Consider restricting access to plugin configuration endpoints via other security controls as a temporary mitigation.