Chative Live Chat and Chatbot WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Chative Live Chat and Chatbot plugin for WordPress, affecting all versions through 1.1. The issue arises from inadequate nonce validation in the 'add_chative_widget_action()' function. This vulnerability allows unauthenticated attackers to manipulate the channel ID or organization ID by sending a forged request, provided they can deceive a site administrator into clicking a link. Such exploitation could redirect the live chat widget to a channel controlled by the attacker.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the channel ID or organization ID, allowing attackers to redirect the live chat widget to an attacker-controlled channel.

Remediation

Users are advised to update the Chative Live Chat and Chatbot plugin to version 1.2 or a newer patched version.