CVE-2024-38790: Smartsupp Live Chat CSRF Vulnerability

CVE-2024-38790 Overview

CVE-2024-38790 is a Cross-Site Request Forgery (CSRF) vulnerability in the Smartsupp smartsupp-live-chat WordPress plugin, which provides live chat, chatbots, AI, and lead generation features. The flaw affects all versions from unspecified early releases through version 3.6. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unauthorized state-changing actions in the plugin without the victim's consent. The issue is tracked under CWE-352 and carries a network attack vector requiring user interaction.

Critical Impact
A successful exploit lets a remote attacker modify plugin state or configuration on behalf of a logged-in WordPress administrator, resulting in a high integrity impact on the affected site.

Affected Products

Smartsupp – live chat, chatbots, AI and lead generation (WordPress plugin smartsupp-live-chat)
All versions up to and including 3.6
WordPress sites running the vulnerable plugin with authenticated administrators

Discovery Timeline

2025-01-02 - CVE-2024-38790 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38790

Vulnerability Analysis

The Smartsupp live chat plugin exposes administrative actions that lack anti-CSRF protections. WordPress provides a built-in nonce mechanism through wp_nonce_field() and check_admin_referer() to bind sensitive requests to a specific user session. In vulnerable versions of smartsupp-live-chat through 3.6, one or more privileged endpoints do not validate a nonce before processing state-changing requests. An attacker can therefore stage a request that WordPress will accept as legitimate when submitted by an authenticated administrator's browser.

Exploitation requires the victim to be logged into WordPress and to visit or interact with an attacker-controlled page. The impact is bounded to integrity: an attacker can alter plugin settings but cannot directly read sensitive data or take the site offline through this issue alone. Modified chat configuration could, however, be chained with client-side injection or brand impersonation attacks against site visitors.

Root Cause

The root cause is missing or insufficient CSRF token validation (CWE-352) on privileged plugin request handlers. Without a nonce check tied to the administrator's session, the plugin trusts any authenticated request bearing valid WordPress cookies, regardless of the request origin.

Attack Vector

Exploitation follows a standard CSRF chain. The attacker hosts a page containing an auto-submitting form or fetch request targeting the vulnerable Smartsupp administrative endpoint. When a WordPress administrator with an active session loads the malicious page, the browser attaches the site's authentication cookies to the forged request. The plugin processes the request as if it originated from the WordPress admin dashboard. No credentials are stolen and no code is executed on the server outside the plugin's normal request flow. Additional technical details are available in the Patchstack Vulnerability Advisory.

No public proof-of-concept exploit code is currently listed for this issue. The vulnerability mechanism can be reproduced by submitting any plugin administrative action without a valid _wpnonce parameter and observing whether the request succeeds.

Detection Methods for CVE-2024-38790

Indicators of Compromise

Unexpected changes to Smartsupp plugin settings, including chat widget keys, appearance configuration, or integration parameters that administrators did not make.
WordPress POST requests to Smartsupp administrative endpoints with a Referer header pointing to an external domain rather than /wp-admin/.
Administrator sessions that submit plugin configuration changes shortly after visiting untrusted third-party sites.

Detection Strategies

Inspect web server access logs for POST requests to wp-admin/admin.php or admin-ajax.php targeting Smartsupp actions with missing or invalid _wpnonce parameters.
Compare current plugin option values against known-good backups stored in the wp_options table for keys owned by smartsupp-live-chat.
Correlate authenticated admin activity with outbound browsing patterns to identify potential CSRF trigger events.

Monitoring Recommendations

Enable WordPress audit logging to capture every settings change made under the Smartsupp plugin, including the requesting IP address, user agent, and referer.
Alert on plugin configuration changes performed outside approved maintenance windows.
Forward WordPress and web server logs to a centralized analytics platform for retention and cross-source correlation.

How to Mitigate CVE-2024-38790

Immediate Actions Required

Update the Smartsupp smartsupp-live-chat plugin to a version released after 3.6 that addresses the CSRF issue.
Audit the plugin's current settings and restore any unauthorized changes from a known-good backup.
Require administrators to log out of WordPress when not actively managing the site to shrink the CSRF exploitation window.

Patch Information

Refer to the Patchstack Vulnerability Advisory for the fixed version and vendor-supplied remediation guidance. Apply the update through the WordPress plugin manager or via WP-CLI and confirm the installed version is greater than 3.6.

Workarounds

Deactivate the Smartsupp plugin until it can be updated on sites where the live chat feature is not business-critical.
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to Smartsupp admin endpoints when the Referer header does not match the site's own domain.
Enforce SameSite=Lax or SameSite=Strict cookie attributes on WordPress session cookies to reduce cross-origin request risk.

bash

# Update the Smartsupp plugin using WP-CLI
wp plugin update smartsupp-live-chat

# Verify the installed version is greater than 3.6
wp plugin get smartsupp-live-chat --field=version

# Temporarily deactivate the plugin if a patched version is unavailable
wp plugin deactivate smartsupp-live-chat