Five Live Chat REST routes were registered with a permission callback of __return_true, leaving them open to unauthenticated callers, and a conversation update matched only on the conversation id. An attacker could read and modify other visitors’ conversations. The routes now verify a REST nonce and the update verifies the conversation belongs to the calling visitor.
This vulnerability affects the following application versions:
- King Addons for Elementor 51.1.44
- King Addons for Elementor 51.1.45
- King Addons for Elementor 51.1.46
- King Addons for Elementor 51.1.47
- King Addons for Elementor 51.1.49
- King Addons for Elementor 51.1.51
- King Addons for Elementor 51.1.52
- King Addons for Elementor 51.1.53
- King Addons for Elementor 51.1.54
- King Addons for Elementor 51.1.55
- King Addons for Elementor 51.1.56
- King Addons for Elementor 51.1.57
- King Addons for Elementor 51.1.58
- King Addons for Elementor 51.1.59
- King Addons for Elementor 51.1.60
- King Addons for Elementor 51.1.61
- King Addons for Elementor 51.1.62