Experts at Alert Logic have discovered a vulnerability in the popular WordPress Live Chat plugin that could be exploited by an unauthorized remote attacker to steal chat logs or manipulate chat sessions.
The critical vulnerability, tracked as CVE-2019-12498, is a critical authentication bypass issue (CWE-287 / OWASP Top 10: A2: 2017-Broken Authentication) that affects version 8.0.32 and earlier of the plugin.
The vulnerability is caused by the improper validation check for authentication, the attacker can trigger it to access restricted REST API endpoints.
