One to One User Chat by WPGuppy Missing Capability Check Vulnerability Allowing Unauthenticated Data Access

A vulnerability exists in the One to One User Chat by WPGuppy plugin for WordPress, in all versions through 1.1.4. The issue arises from a missing capability check on the '/wp-json/guppylite/v2/channel-authorize' REST endpoint. This flaw allows unauthenticated attackers to intercept and read private chat messages between users.

Impact

Exploitation of this vulnerability leads to unauthorized access to private chat messages, allowing interception and reading of these messages by unauthenticated users.