The Hive Support plugin suffers from a Cross‑Site Request Forgery flaw, identified as CWE‑352, caused by missing or incorrect nonce validation in the hs_update_ai_chat_settings() function. This allows an unauthenticated attacker to craft a forged request that an administrator may execute by clicking a link or visiting a page, leading to unauthorized reconfiguration of the plugin’s AI chat settings, such as API keys. The attacker could then redirect notifications or leak data to attacker‑controlled endpoints. The primary impact is data leakage and potential loss of control over the chat functionality, which could expose sensitive information or allow further exploitation of the site.

Products affected are Hive Support | AI‑Powered Help Desk, Live Chat & AI Chat Bot plugin for WordPress, all versions up to and including 1.2.5. Any WordPress installation using these plugin versions and the associated admin AJAX endpoint is vulnerable.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated site administrator to unknowingly execute a crafted request, making it a user‑interaction dependent CSRF attack. While the risk is moderate, the potential for data exfiltration motivates prompt remediative action.