Kognetiks Chatbot for WordPress <= 2.1.8 - Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant Modification

Vulnerability

The Kognetiks Chatbot for WordPress plugin (also known as chatbot-chatgpt) is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 2.1.8. The CSRF flaw exists in the update_assistant, add_new_assistant, and delete_assistant functions due to missing or incorrect nonce validation. This allows an unauthenticated attacker to forge requests that perform assistant modifications, provided they can trick a site administrator into interacting with a malicious link or page.

Exploitation

An attacker does not need any authentication or prior access to the site. The attack requires the attacker to craft a malicious request (e.g., via a link or form submission) that targets one of the vulnerable functions. The attacker must then convince a logged-in WordPress administrator to trigger that request, for example by clicking a link or visiting a specially crafted page. No user interaction beyond the administrator's click is needed.

Impact

A successful CSRF attack can lead to unauthorized addition, modification, or deletion of chatbot assistants. An attacker could alter the assistant's configuration, potentially changing the chatbot's behavior or injecting malicious content. The impact is limited to the assistant management functionality; it does not directly lead to full site compromise, but it can degrade trust, modify assistant responses, or cause denial of service by deleting assistants.

Mitigation

The vendor has not yet released a fixed version for this specific CVE. As of the last known plugin update to version 2.4.6 (tested up to WordPress 6.9.4), no explicit mention of a patch for CSRF in these functions is available. Users are advised to disable the plugin or restrict access to the vulnerable administrative functions until a patched version is released. The plugin is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. [1]