CVE-2024-13646: Single User Chat Plugin DoS Vulnerability

CVE-2024-13646 Overview

CVE-2024-13646 affects the Single User Chat plugin for WordPress in all versions up to and including 0.5. The vulnerability stems from insufficient validation in the single_user_chat_update_login function [CWE-285]. Authenticated attackers with subscriber-level access or above can modify arbitrary option values on the WordPress site to the string login. This can trigger site errors, deny service to legitimate users, or enable settings such as user registration. The flaw is classified as an authorization bypass leading to denial of service and unauthorized data modification.

Critical Impact
Any authenticated subscriber can overwrite WordPress option values, potentially breaking site functionality or enabling insecure settings like open user registration.

Affected Products

Aakashbhagat Single User Chat plugin for WordPress
All versions up to and including 0.5
WordPress sites with the plugin installed and user registration enabled

Discovery Timeline

2025-01-30 - CVE-2024-13646 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13646

Vulnerability Analysis

The Single User Chat plugin exposes the single_user_chat_update_login function without adequate capability checks or nonce validation. Any authenticated user, including subscribers, can invoke the handler and pass an arbitrary option name. The function then writes the value login to that WordPress option via the standard options API.

This breaks the intended trust boundary because WordPress options control site-wide behavior. Overwriting critical options such as siteurl, home, template, or stylesheet with the string login produces a broken site state. Overwriting boolean-style options such as users_can_register with a truthy value enables self-service account creation.

The primary impact is denial of service through site misconfiguration. A secondary impact is expanded attack surface when registration or similar toggles are silently enabled.

Root Cause

The root cause is missing authorization enforcement [CWE-285] on a state-changing plugin endpoint. The handler does not verify current_user_can() for an appropriate capability such as manage_options, nor does it validate the option name against an allow-list. Reference the WordPress Plugin Code Review for the vulnerable source location.

Attack Vector

An attacker registers or logs in as a subscriber-level user. The attacker then sends an authenticated request to the plugin endpoint bound to single_user_chat_update_login, supplying the target option name as a parameter. The plugin writes the string login into that option, producing either denial of service or an unsafe configuration change. No user interaction beyond the attacker's own session is required.

See the Wordfence Vulnerability Report for additional exploitation context.

Detection Methods for CVE-2024-13646

Indicators of Compromise

WordPress option values unexpectedly set to the literal string login in the wp_options table.
Site errors, white screens, or broken theme rendering shortly after subscriber-level authentication events.
Unexpected enablement of the users_can_register option or sudden spikes in new subscriber registrations.

Detection Strategies

Query the wp_options table for rows where option_value = 'login' and correlate against a known-good baseline.
Monitor WordPress admin-ajax and REST endpoints for authenticated requests invoking single_user_chat_update_login from non-admin roles.
Alert on modifications to security-sensitive options such as siteurl, home, users_can_register, and default_role.

Monitoring Recommendations

Enable a WordPress audit-logging plugin to record all option changes with actor, timestamp, and source IP.
Forward web server access logs to a centralized log platform and search for POST requests to plugin action handlers from subscriber accounts.
Track new user registrations and flag bursts that follow option-change events.

How to Mitigate CVE-2024-13646

Immediate Actions Required

Deactivate and remove the Single User Chat plugin until a patched release is confirmed available.
Audit the wp_options table and restore any option value that has been overwritten with the string login.
Review and disable open user registration if it was not intentionally enabled.
Rotate credentials for any accounts created during suspected exploitation windows.

Patch Information

No vendor-issued patch is referenced in the advisory. The vulnerability exists in all versions up to and including 0.5. Site operators should treat the plugin as unpatched and remove it. Track the Wordfence Vulnerability Report for updates.

Workarounds

Remove the plugin directory from wp-content/plugins/single-user-chat/ to eliminate the vulnerable endpoint.
Restrict subscriber-level accounts by disabling self-registration via Settings → General → Membership.
Deploy a web application firewall rule to block authenticated requests to the single_user_chat_update_login action from non-administrator roles.
Enforce least privilege on WordPress roles and periodically audit accounts with subscriber access.

bash

# Disable open registration and remove the vulnerable plugin
wp option update users_can_register 0
wp plugin deactivate single-user-chat
wp plugin uninstall single-user-chat