CVE-2024-5992

🗓️ 09 Jul 2024 09:15:08Reported by [email protected]Type

The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_chatbot_token' and 'update_chatbot_position' functions in all versions up to, and including, 3.0.1. This makes it possible for unauthenticated attackers to change chatbot settings, leading to unavailability or other changes

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-5992	9 Jul 202411:49	–	circl
CNNVD	WordPress plugin Cliengo - Chatbot security vulnerability	9 Jul 202400:00	–	cnnvd
CVE	CVE-2024-5992	9 Jul 202408:33	–	cve
Cvelist	CVE-2024-5992 Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update	9 Jul 202408:33	–	cvelist
EUVD	EUVD-2024-47108	3 Oct 202520:07	–	euvd
Patchstack	WordPress Cliengo - Chatbot plugin <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update vulnerability	9 Jul 202407:24	–	patchstack
Patchstack	WordPress Cliengo – Chatbot Plugin <= 3.0.1 is vulnerable to Broken Access Control	9 Jul 202400:00	–	patchstack
Positive Technologies	PT-2024-37297 · WordPress · Cliengo – Chatbot	9 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-5992	23 May 202508:29	–	redhatcve
Vulnrichment	CVE-2024-5992 Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update	9 Jul 202408:33	–	vulnrichment

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/a7f0afe8-234a-4c3f-87c8-f3f23ac94fe3
plugins	www.plugins.trac.wordpress.org/changeset/3118688/
plugins	www.plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php
plugins	www.plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php

17 Jun 2026 08:17Current

CVSS 3.16.5

EPSS0.00536

CWE-862