WordPress Plugin Vulnerabilities

Cliengo - Chatbot < 3.0.3 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update

Description

The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_session' function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the session token of the chatbot.

Affects Plugins

Plugin icon
cliengo
Fixed in 3.0.3

References

CVE
CVE-2024-5993
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0a13e87d-51cd-43b0-a658-900a174738fc

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Lucio Sá
Verified
No
WPVDB ID
47ae4925-f131-44c2-8278-6f3bf217458c

Timeline

Publicly Published
2024-07-08 (about 1 year ago)
Added
2024-07-08 (about 1 year ago)
Last Updated
2024-08-01 (about 1 year ago)

Other

Published
Title
Published
2025-10-16
Title
Kallyas < 4.23.0 - Missing Authorization
Published
2024-06-19
Title
Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer < 1.1.1 - Missing Authorization
Published
2025-12-12
Title
Mavix Education < 1.1 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation
Published
2024-12-02
Title
Pie Register Premium < 3.8.3.3 - Unauthenticated Arbitrary File Upload
Published
2024-02-05
Title
WP Club Manager – WordPress Sports Club Plugin < 2.2.11 - Missing Authorization to Unauthenticated Event Permalink Update