CVE-2024-5993: 
WordPress vulnerability analysis and mitigation

The Cliengo – Chatbot plugin for WordPress contains a vulnerability (CVE-2024-5993) discovered on July 9, 2024, affecting all versions up to and including 3.0.1. The vulnerability stems from a missing capability check on the 'update_session' function, which could allow unauthorized modification of data (NVD CVE).

The vulnerability is characterized by a missing capability check in the 'update_session' function, which allows authenticated users with Subscriber-level access or higher to modify the chatbot's session token. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L (Wordfence Intel).

The vulnerability allows authenticated attackers with Subscriber-level access and above to manipulate the chatbot's session token, potentially affecting the integrity and availability of the chatbot service (NVD CVE).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack complexity is considered low, requiring network access but no user interaction (Wordfence Intel).

Users should update to a version newer than 3.0.1 of the Cliengo – Chatbot plugin to address this vulnerability (NVD CVE).