Cross-Site Request Forgery Vulnerability in Chative Live Chat and Chatbot Plugin for WordPress

CVE-2024-12541

Summary

The Chative Live Chat and Chatbot plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit Cross-Site Request Forgery due to insufficient nonce validation in the add_chative_widget_action() function. By tricking site administrators into performing actions, such as clicking on a malicious link, attackers can alter the channel ID or organization ID of the live chat widget. This could redirect users to an attacker-controlled channel, compromising the integrity and security of the communication.

References