published March 20, 2020
⚠️ A missing permission check in the WP Live Chat Support plugin could leave the door ajar for some sneaky REST API calls! 🚪💬 Think of a restaurant that lets delivery drivers pick up orders without verifying their credentials — a recipe for a mix-up that could leave your customers unhappy! 🍽️🛍️ Without proper permission checks, an attacker could exploit this vulnerability to make unauthorized API calls, potentially leading to unwanted access to chat data or other sensitive functionalities. It might not be catastrophic, but it could definitely leave your site feeling a bit vulnerable!
Think of a restaurant that lets delivery drivers pick up orders without verifying their credentials — a recipe for a mix-up that could leave your customers unhappy! 🍽️🛍️ This vulnerability arises because the WP Live Chat Support plugin fails to invoke the wplc_api_permission_check mechanism for certain REST API calls, allowing unauthorized access to endpoints that should be protected.
Without proper permission checks, an attacker could exploit this vulnerability to make unauthorized API calls, potentially leading to unwanted access to chat data or other sensitive functionalities. It might not be catastrophic, but it could definitely leave your site feeling a bit vulnerable! Update the WP Live Chat Support plugin to version 8.0.33 or later to ensure proper permissions are enforced. Additionally, review your API settings and access controls to tighten security further! You've got this! Update your plugin and keep your WordPress site secure! 🛡️✨