PT-2025-24034 · WordPress · Hive Support

Vo Thi Ngoc Nhi

·

Published

2025-06-06

·

Updated

2025-06-06

·

CVE-2025-5019

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress versions 1.2.2 and earlier
Description The issue is related to Cross-Site Request Forgery due to incomplete or incorrect nonce validation in the hs update ai chat settings() function. This allows unauthenticated attackers to reconfigure the plugin's AI/chat settings, including API keys, and potentially redirect notifications or leak data to attacker-controlled endpoints via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.
Recommendations For versions 1.2.2 and earlier, as a temporary workaround, consider disabling the hs update ai chat settings() function until a patch is available. Restrict access to the plugin's AI/chat settings to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-5019

Affected Products

Hive Support