The Kognetiks Chatbot for WordPress plugin suffers from a CSRF vulnerability (CWE-352) in all versions up to 2.1.8. The issue arises because the update_assistant, add_new_assistant, and delete_assistant functions lack proper nonce validation, enabling attackers to forge requests that modify chatbot assistants without authentication if an administrator is tricked into executing the action. This vulnerability has a CVSS 3.1 base score of 4.3, reflecting a medium severity level with network attack vector, low attack complexity, no privileges required, and user interaction needed.

An attacker can modify chatbot assistants on a vulnerable WordPress site by exploiting the CSRF vulnerability, potentially altering chatbot behavior or configuration. There is no direct confidentiality or availability impact reported. The attack requires tricking an authenticated administrator to perform an action, limiting the scope to administrative users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider disabling or restricting the Kognetiks Chatbot plugin functions that modify assistants. Monitoring for updates from the vendor is recommended.