CVE-2025-6792: 
WordPress vulnerability analysis and mitigation

CVE-2025-6792 is an unauthorized data access vulnerability in the "One to one user Chat by WPGuppy" plugin for WordPress, caused by a missing capability check on the /wp-json/guppylite/v2/channel-authorize REST API endpoint. All versions up to and including 1.1.4 are affected. The flaw allows unauthenticated remote attackers to intercept and view private chat messages between users. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function): the plugin's REST API endpoint /wp-json/guppylite/v2/channel-authorize does not enforce any WordPress capability or authentication check before granting access to channel data. An attacker can send unauthenticated HTTP requests directly to this endpoint over the network with low complexity and no user interaction required. Because no privilege is required and the endpoint is network-accessible, exploitation is straightforward for any remote attacker who can reach the WordPress installation (Red Hat CVE).

Successful exploitation allows unauthenticated attackers to read private one-to-one chat messages exchanged between WordPress users, resulting in a confidentiality breach. There is no impact on integrity or availability. The exposed data may include sensitive personal communications, potentially violating user privacy and applicable data protection regulations (Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low attack complexity and lack of authentication requirements make it relatively easy to exploit if targeted, but the limited impact scope may reduce attacker motivation (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the "One to one user Chat by WPGuppy" plugin version 1.1.4 or earlier using tools like WPScan or by checking publicly accessible plugin metadata at /wp-content/plugins/wpguppy-lite/readme.txt.
2. Locate the vulnerable endpoint: Confirm the REST API endpoint is accessible by sending a GET or POST request to https://<target>/wp-json/guppylite/v2/channel-authorize without any authentication headers or cookies.
3. Enumerate channels: Supply channel identifiers (e.g., user IDs or channel IDs) as parameters to the endpoint to retrieve authorization tokens or channel data without authentication.
4. Access private messages: Use the obtained channel access to retrieve private chat message content between users, achieving unauthorized disclosure of confidential communications (Red Hat CVE).

• Network: Unauthenticated HTTP requests (no session cookies or Authorization headers) to /wp-json/guppylite/v2/channel-authorize from external or unexpected IP addresses.
• Logs: WordPress access logs showing repeated or automated requests to the guppylite REST API endpoint, particularly from a single IP or user agent, without corresponding authenticated sessions.
• Logs: HTTP 200 responses to the above endpoint from unauthenticated sources, indicating successful unauthorized access.

WordPress site administrators should update the "One to one user Chat by WPGuppy" plugin to a version beyond 1.1.4 that includes a proper capability check on the affected REST API endpoint. If no patched version is yet available, consider temporarily deactivating the plugin until a fix is released. Additionally, web application firewall (WAF) rules can be configured to block unauthenticated requests to the /wp-json/guppylite/v2/channel-authorize endpoint as a short-term mitigation (Red Hat CVE).