What the vulnerability does
01Description
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due to missing or incorrect nonce validation on the update_assistant, add_new_assistant, and delete_assistant functions. This makes it possible for unauthenticated attackers to modify assistants via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
The Kognetiks Chatbot plugin for WordPress versions 2.1.8 and earlier is vulnerable to cross-site request forgery (CSRF). An attacker can trick a logged-in site administrator into performing unintended actions by crafting a malicious link or page. The attacker cannot read data or cause downtime, but can modify site settings or data if the admin visits a compromised page.
What an attacker can do
03Attacker Capabilities
Trick an admin into performing unintended actions like changing plugin settings or data.
Potential impact on your site
04Site Impact
An attacker could modify chatbot settings or data if they trick your admin into clicking a malicious link.
Conditions required to exploit
05Prerequisites
Admin must be logged in and visit a page controlled by the attacker.
Key dates
06Disclosure timeline
November 13, 2024
CVE published
April 8, 2026
Record updated
