CVE-2024-11143

Name of the Vulnerable Software and Affected Versions Kognetiks Chatbot for WordPress plugin versions up to, and including, 2.1.8

Description The issue is related to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the update assistant, add new assistant, and delete assistant functions. This allows unauthenticated attackers to modify assistants via a forged request if they can trick a site administrator into performing an action.

Recommendations For versions up to, and including, 2.1.8, update to the latest version to mitigate risks. As a temporary workaround, consider disabling the update assistant, add new assistant, and delete assistant functions until a patch is available. Restrict access to these functions to minimize the risk of exploitation.