Junglewise Threat Intelligence

CVE-2026-1832: ThriveDesk WordPress plugin missing authorization in thrivedesk_clear_cache

CVE-2026-1832 · Severity: medium · CVSS 4.3 · Published 2026-07-11

Executive brief

ThriveDesk is a WordPress plugin used to provide live chat, AI chatbots, and helpdesk services to website visitors. A security flaw in the plugin allows any logged-in user, even those with low-level 'Subscriber' permissions, to clear the plugin's internal cache. While this does not expose sensitive data, it could be used to disrupt site performance or interfere with the proper functioning of the chat and support tools.

Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the 'thrivedesk_clear_cache' AJAX action. The plugin fails to perform a capability check (such as current_user_can()) to verify if the requesting user has administrative privileges before executing the cache clearing logic. An authenticated attacker with Subscriber-level access or higher can send a crafted AJAX request to trigger this action. This allows for unauthorized modification of application state by clearing the plugin's cache. The issue is addressed in version 2.2.0.

Affected products

  • ThriveDesk Agentic Help Desk Plugin for WordPress – Live Chat, AI Chatbot & Ticketing – ThriveDesk up to, and including, 2.1.7

Timeline

  • 2026-07-11: advisory: Wordfence published the vulnerability details.
  • 2026-07-11: disclosed

References