The Hive Support WordPress plugin contains a CSRF vulnerability due to improper nonce validation in the hs_update_ai_chat_settings() function. This allows attackers to forge requests that, if executed by an authenticated administrator, can alter AI/chat configuration settings such as API keys. The vulnerability affects all versions up to 1.2.5. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and limited confidentiality and integrity impact. No known exploits in the wild or patches have been reported yet.

An attacker can exploit this vulnerability by tricking a site administrator into submitting a crafted request, leading to unauthorized changes in the plugin’s AI/chat settings. This could result in exposure or redirection of sensitive data, such as API keys or notifications, to attacker-controlled endpoints. The impact is limited to confidentiality and integrity with no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or requests that could trigger plugin configuration changes. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.