Vulnerability · Published Dec 6, 2021 · Assigned by WPScan
CVE-2021-24914Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal
High 8.0
In plain English
A high-severity missing authorization in Tawk.To Live Chat from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Tawk.To Live Chat | 0.6.0 – before 0.6.0 |
Weakness: CWE-862