Vulnerability Description
The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tawk | Tawk.To Live Chat | < 0.6.0 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/39392055-8cd3-452f-8bcb-a650f5bddc2eExploitThird Party Advisory
- https://wpscan.com/vulnerability/39392055-8cd3-452f-8bcb-a650f5bddc2eExploitThird Party Advisory
FAQ
What is CVE-2021-24914?
CVE-2021-24914 is a vulnerability with a CVSS score of 8.0 (HIGH). The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The firs...
How severe is CVE-2021-24914?
CVE-2021-24914 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-24914?
Check the references section above for vendor advisories and patch information. Affected products include: Tawk Tawk.To Live Chat.