CVE-2021-24914: Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-06 · updated 2026-06-17
Weakness: CWE-862

Description

The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.

Affected products

Tawk.To Live Chat: before 0.6.0 — fixed in 0.6.0

How to fix

Upgrade to a fixed version: Tawk.To Live Chat 0.6.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24914 or the next vulnerability affects your stack