CVE-2026-97305: Authorization Bypass Through User-Controlled Key in Themeisle AI Chatbot for WordPress – Hyve Lite

This vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite (versions >=0 and <2.0.3) allows an attacker to bypass authorization controls due to incorrectly configured access control security levels. The issue arises from the use of a user-controlled key that improperly restricts access, enabling unauthorized actions within the plugin. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low impact on integrity, and no required privileges or user interaction.

An attacker can bypass authorization mechanisms in the affected plugin versions, potentially gaining unauthorized access to functionalities or data that should be restricted. This could lead to unauthorized actions within the WordPress environment where the plugin is installed. There is no indication of privilege escalation, user interaction, or confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory link is provided, users should monitor Themeisle's official channels for updates and apply any released patches promptly. In the meantime, consider restricting access to the plugin's features or disabling it if feasible until a fix is available.