# Chameleon <= 1.4.9 - Missing Authorization to Unauthenticated Style Settings Update

- **ID:** WPSEC-2026-2173
- **Plugin:** Chameleon (`chameleon`), https://wordpress.org/plugins/chameleon/
- **Affected versions:** all versions before 1.5.0
- **Fixed in:** 1.5.0 (Update to 1.5.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-31)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/chameleon
- **Fix released:** 2026-10-30
- **Published:** 2026-10-31
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2173/

## Description

The Chameleon plugin for WordPress is vulnerable to unauthorized modification of data via the third-party style switcher in all versions up to, and including, 1.4.9, due to a missing capability check on the wpc_third_party_support() function. The function is hooked to admin_init, which also fires for unauthenticated requests to admin-ajax.php and admin-post.php. This makes it possible for unauthenticated attackers to overwrite the site-wide Alphabetic Pagination style and template choices stored in the wp_chameleon option with arbitrary values through the 'ap_style' and 'ap_template' parameters. The Alphabetic Pagination plugin must be active.

## References

- https://wpsec.com/vuln/WPSEC-2026-2173/
- https://plugins.svn.wordpress.org/chameleon/tags/1.5.0/
- https://wordpress.org/plugins/chameleon/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2173/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.