CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'reset_settings' AJAX endpoint in all versions up to, and including, 3.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings.
Explanation of Vulnerability in Simple Terms
WSChat versions 3.1.6 and earlier lack proper authorization checks, allowing authenticated users to modify chat settings or data they should not have access to. An attacker with a low-privilege WordPress account can change configuration or interfere with chat functionality. Update to a version newer than 3.1.6 to resolve this issue.
What an attacker can do
Modify chat settings or data without proper authorization as a low-privilege user.
Potential impact on your site
Unauthorized users can alter chat configurations, potentially disrupting customer support or modifying chat behavior.
Conditions required to exploit
Attacker must have a valid WordPress user account with at least low-level privileges.
Key dates
External resources
Related vulnerabilities
