Executive brief
The Essential Chat Support plugin for WordPress, which adds chat functionality to websites, contains a security flaw that allows unauthorized individuals to reset the plugin's configuration. An attacker can remotely revert all chat settings, display rules, and custom styling to their original factory defaults without needing a password. This can disrupt customer support operations and erase custom branding or integration settings on the affected website.
Technical details
The Essential Chat Support plugin for WordPress (versions up to 1.0.1) suffers from a missing authorization check (CWE-862) in its settings handling logic. Specifically, the plugin fails to verify administrative privileges before processing a reset request. An unauthenticated remote attacker can exploit this by sending a crafted POST request containing the parameter 'ecs_reset_settings=1'. Successful exploitation results in the immediate restoration of all plugin settings—including general configurations, display rules, custom CSS, and WooCommerce tab settings—to their default state.
Affected products
- Essential Chat Support Essential Chat Support Up to, and including, 1.0.1
Timeline
- 2026-05-16: disclosed: Initial advisory publication
References
- https://plugins.trac.wordpress.org/browser/essential-chat-support/trunk/includes/admin/settings/register-settings.php
- https://plugins.trac.wordpress.org/browser/essential-chat-support/trunk/includes/ecs-functions.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6b98ea22-4c82-45c6-8e29-75cc9a9185be?source=cve