A Cross‑Site Request Forgery (CSRF) flaw exists in Freshchat plugin versions up to 2.3.4. The weakness, classified as CWE‑352, allows an attacker to trick a logged‑in user into submitting malicious requests that the plugin will process without proper verification, potentially enabling the attacker to perform unauthorized actions on the site. The impact can range from data alteration to other sensitive operations, depending on the capabilities granted to the affected user session.

The vulnerability affects the Freshchat WordPress plugin, with all releases up to and including version 2.3.4 impacted. Any WordPress installation that has this plugin installed and has users who may be logged in during a CSRF attack is subject to risk.

The CVSS v3 base score of 4.3 signals moderate severity. The EPSS score of <1% indicates the measured likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation. Likely exploitation would involve a malicious webpage carefully crafted to send requests that exploit the attacker’s discovery of the victim’s authenticated session, thereby triggering the unwanted action on the Freshchat plugin.