CSRF in Tawk Tawk.to Live Chat
CVE-2021-24914
The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.
Vulnerability class: Broken Access Control
EPSS: 0.005 (41.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Tawk Tawk.to_live_chat
- Unknown Tawk.to Live Chat — versions 0.6.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- contact@wpscan.com (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-24914?
- CVE-2021-24914 is a high-severity vulnerability in Tawk Tawk.to Live Chat, classified under Missing Authorization. CVSS score: 8.0/10. Published 2021-12-06.
- How severe is CVE-2021-24914?
- High severity. CVSS v3 base score is 8.0 out of 10.
- Is CVE-2021-24914 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.