CVE-2024-11143

Summary

CVE-2024-11143: The Kognetiks Chatbot plugin for WordPress, versions up to 2.1.8, suffers from a Cross-Site Request Forgery (CSRF) vulnerability. This issue arises due to faulty nonce validation on the update_assistant, add_new_assistant, and delete_assistant functions. An unauthenticated attacker can manipulate chatbot assistants by forging requests and persuading an administrator to perform a specific action, such as clicking a malicious link. The vulnerability poses a significant risk, as it allows attackers to modify the chatbot configurations without proper authentication.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.