WordPress Freshchat プラグイン <= 2.3.4 - クロスサイトリクエストフォージェリ (CSRF) 脆弱性

A successful CSRF attack could allow an attacker to modify Freshchat configurations, access or delete customer data, or perform other administrative actions as the logged-in user. The impact is directly tied to the privileges of the user being targeted. For instance, an administrator account compromised via CSRF could grant the attacker full control over the Freshchat instance and potentially the broader WordPress site. This vulnerability highlights the importance of proper CSRF protection mechanisms within web applications, especially those handling sensitive user data.

WordPress sites utilizing the Freshchat plugin, particularly those with administrator accounts that are frequently targeted or have weak password policies, are at increased risk. Shared hosting environments where multiple WordPress installations share the same server resources are also more vulnerable, as a compromise of one site could potentially impact others.

• wordpress / composer / npm:

grep -r 'freshchat_settings_update' /var/www/html/wp-content/plugins/

• generic web:

curl -I https://your-freshchat-site.com/wp-admin/admin-ajax.php?action=freshchat_settings_update&setting_name=some_setting&setting_value=some_value -v

1. 2025-12-16Disclosure

   disclosure

1. 予約済み2025-10-29
2. 公開日2025-12-16
3. 更新日2026-04-28
4. EPSS 更新日2026-03-23

The primary mitigation is to upgrade the Freshchat WordPress plugin to version 2.3.5 or later, which contains the fix. If immediate upgrading is not possible, implement temporary mitigations such as enabling a Web Application Firewall (WAF) with CSRF protection rules. Additionally, enforce strict user input validation and consider implementing double opt-in for sensitive actions within Freshchat. Regularly review Freshchat configurations and user permissions to identify and address any potential vulnerabilities. After upgrading, confirm the fix by attempting a CSRF attack against a test user account and verifying that the action is blocked.

アクティブインストール数

1Kニッチ

プラグイン評価

2.9

WordPressが必要

3.0.1+

動作確認済みバージョン

5.8.13

PHPが必要

5.2.4+