Hive Support WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Hive Support WordPress plugin, specifically in versions through 1.2.2. The issue arises from inadequate nonce validation in the 'hs_update_ai_chat_settings' function, allowing unauthenticated attackers to manipulate the plugin's AI and chat settings, including API keys. Exploitation could lead to unauthorized data redirection or data leakage to attacker-controlled endpoints, provided the attacker can deceive a site administrator into initiating the action.

Impact

Exploitation of this vulnerability could result in unauthorized changes to the plugin's AI and chat settings, including API keys, and potentially allow for data to be sent to an attacker's controlled endpoint.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.