CVE-2025-58666: Kommo Chat Button Auth Bypass Vulnerability

CVE-2025-58666 Overview

CVE-2025-58666 is a missing authorization vulnerability in the Kommo Website Chat Button WordPress plugin (website-chat-button-kommo-integration). The flaw affects all versions up to and including 1.3.1. Attackers with low-privileged authenticated accounts can exploit incorrectly configured access control checks to perform actions restricted to higher-privileged users. The vulnerability is tracked under CWE-862: Missing Authorization.

Critical Impact

Authenticated attackers with minimal privileges can bypass access control restrictions in the plugin, leading to unauthorized modification of integration settings on affected WordPress sites.

Affected Products

• Kommo Website Chat Button: Kommo integration plugin for WordPress
• All versions from n/a through 1.3.1
• WordPress sites running the vulnerable website-chat-button-kommo-integration plugin

Discovery Timeline

• 2025-09-22 - CVE-2025-58666 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58666

Vulnerability Analysis

The vulnerability originates from incorrectly configured access control security levels within the Kommo Website Chat Button plugin. The plugin exposes functionality that fails to verify whether the requesting user holds the appropriate role or capability before executing privileged operations. Attackers only need low-level authentication, such as a subscriber-level account, to reach the affected code paths.

Exploitation requires network access to the WordPress site and does not require user interaction. The impact is limited to integrity, with no direct confidentiality or availability consequences reported. Because WordPress sites frequently permit open registration, the low privilege requirement broadens the pool of potential attackers on affected sites.

Refer to the Patchstack Vulnerability Report for additional advisory details.

Root Cause

The root cause is a missing authorization check [CWE-862]. The plugin registers handlers, such as AJAX or admin-post endpoints, without validating the user's capability using functions like current_user_can() or verifying nonces bound to the intended role. As a result, any authenticated user can invoke functions intended for administrators.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the vulnerable plugin endpoint. Because the handler does not enforce role-based authorization, the request succeeds and modifies plugin state. See the Patchstack advisory linked above for endpoint specifics.

// No verified proof-of-concept code is available for CVE-2025-58666.
// Refer to the Patchstack advisory for technical exploitation details.

Detection Methods for CVE-2025-58666

Indicators of Compromise

• Unexpected changes to Kommo Website Chat Button plugin configuration or option values in wp_options.
• HTTP POST requests to plugin AJAX or admin endpoints originating from low-privileged user sessions.
• New or modified integration credentials or chat widget parameters without corresponding administrator activity.

Detection Strategies

• Audit WordPress access logs for requests to admin-ajax.php or plugin-specific endpoints that reference the website-chat-button-kommo-integration action names.
• Correlate authenticated non-admin session identifiers with privileged plugin operations.
• Use file integrity monitoring to detect unauthorized modification of plugin option values stored in the database.

Monitoring Recommendations

• Enable WordPress audit logging plugins to record capability checks, option updates, and role changes.
• Forward web server and application logs to a centralized SIEM for correlation with authentication events.
• Alert on any successful plugin configuration change performed by users without the manage_options capability.

How to Mitigate CVE-2025-58666

Immediate Actions Required

• Update the Kommo Website Chat Button plugin to a version later than 1.3.1 once released by the vendor.
• If no patched version is available, deactivate and remove the plugin from affected WordPress installations.
• Review WordPress user accounts and remove unnecessary low-privileged or self-registered accounts.

Patch Information

At the time of publication, the vulnerability affects all versions of the plugin from n/a through 1.3.1. Consult the Patchstack Vulnerability Report for the latest fixed version guidance.

Workarounds

• Restrict access to WordPress admin AJAX endpoints using a web application firewall (WAF) rule that blocks unauthenticated or low-privileged requests to the plugin actions.
• Disable open user registration on the WordPress site by setting Anyone can register to off under Settings > General.
• Enforce least-privilege role assignments and audit membership of the Editor, Author, and Contributor roles.

# Disable the vulnerable plugin via WP-CLI until a patched version is installed
wp plugin deactivate website-chat-button-kommo-integration
wp plugin delete website-chat-button-kommo-integration