Vulnerability in WP Live Chat Support plugin allows stealing logs and insert messages in chats

Developers of WP Live Chat Support plugin, which has more than 50,000 installations, report that users should immediately upgrade plugin to version 8.0.33 or later.

The fact is that in plugin was detected critical vulnerability that allows an attacker who does not have valid credentials to bypass authentication mechanism.

WP Live Chat Support allows adding to the website free chat through which employees can provide support and assistance to resource visitors.

Experts from Alert Logic found that plugin versions 8.0.32 and below allow an unauthenticated attacker to gain access to REST API endpoints, which should not be available under normal circumstances. The vulnerability received the identifier CVE-2019-12498. Due to exploitation of the bug, an attacker can not only steal all the logs of already completed chats, but also interfere with still active chat sessions.

The researchers say that with the help of a bug, an attacker can insert his own messages into active chats, edit them, and carry out DoS attacks, due to which chat sessions will be urgently terminated.

“Note that we had not seen attackers attempt this specific bypass in our customer data, and do not believe that it was being actively exploited”, — report researchers.

Remediation and Mitigation from Alert Logic

The primary resolution of this vulnerability is to update the plugin to the latest version. If this cannot be achieved, then mitigation options may include:

Virtual patching using a WAF to filter traffic destined for the WP Live Chat Support REST endpoint

Interestingly, in the past month, Sucuri’s specialists discovered another dangerous problem in WP Live Chat Support -XSS bug, which allowed automating attacks on vulnerable sites and introducing malicious code without authentication. Criminals quickly began to exploit this vulnerability.

Concluding, according to ZScaler ThreatLabZ, attackers injected malicious JavaScript on vulnerable sites, which organized forced redirects and was responsible for arrival of pop-up windows and fake subscriptions.


About Trojan Killer

Carry Trojan Killer Portable on your memory stick. Be sure that you’re able to help your PC resist any cyber threats wherever you go.

Check Also

MageCart on the Heroku Cloud Platform

Researchers Found Several MageCart Web Skimmers On Heroku Cloud Platform

Researchers at Malwarebytes reported about finding several MageCart web skimmers on the Heroku cloud platform …

Android Spyware CallerSpy

CallerSpy spyware masks as an Android chat application

Trend Micro experts discovered the malware CallerSpy, which masks as an Android chat application and, …

Leave a Reply