CVE-2021-24914
Last modified
CVE-2021-24914 is a high-severity vulnerability rated 8/10 on the CVSS scale. The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. EPSS estimates a 0.52% chance of exploitation in the next 30 days.
Description
The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tawk | Tawk.To Live Chat | < 0.6.0 |
References
- https://wpscan.com/vulnerability/39392055-8cd3-452f-8bcb-a650f5bddc2eExploit, Third Party Advisory
- https://wpscan.com/vulnerability/39392055-8cd3-452f-8bcb-a650f5bddc2eExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-24914?
How severe is CVE-2021-24914?
How do I fix CVE-2021-24914?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-24908The Check & Log Email WordPress plugin before 1.0.4 does not…6.1
- CVE-2021-24909The ACF Photo Gallery Field WordPress plugin before 1.7.5 do…6.1
- CVE-2021-24910The Transposh WordPress Translation WordPress plugin before …6.1
- CVE-2021-24911The Transposh WordPress Translation WordPress plugin before …5.4
- CVE-2021-24912The Transposh WordPress Translation WordPress plugin before …5.4
- CVE-2021-24913The Logo Showcase with Slick Slider WordPress plugin before …4.3
- CVE-2021-24915The Contest Gallery WordPress plugin before 13.1.0.6 does no…9.8
- CVE-2021-24916The Qubely WordPress plugin before 1.8.6 allows unauthentica…7.5
- CVE-2021-24917The WPS Hide Login WordPress plugin before 1.9.1 has a bug w…7.5
- CVE-2021-24918The Smash Balloon Social Post Feed WordPress plugin before 4…5.4
- CVE-2021-24919The Wicked Folders WordPress plugin before 2.8.10 does not s…8.8
- CVE-2021-24920The StatCounter WordPress plugin before 2.0.7 does not sanit…4.8
Are you affected by CVE-2021-24914?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST