What is the CVSS score of CVE-2026-1832?

CVE-2026-1832 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

ThriveDesk CVE-2026-1832

EUVD-2026-43146 MEDIUM

Missing Authorization (CWE-862)

2026-07-11 Wordfence

GHSA-m58j-w5gx-pqhj

WordPress Authentication Bypass Wordpress Plugin Agentic Help Desk Plugin For Wordpress Live Chat Ai Chatbot Ticketing Thrivedesk

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network AJAX endpoint requires subscriber authentication (PR:L); impact is cache deletion only, yielding low integrity and no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 05:22 vuln.today

CVE Published

Jul 11, 2026 - 03:44 nvd

MEDIUM 4.3

DescriptionCVE.org

The ThriveDesk - Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability check on the 'thrivedesk_clear_cache' AJAX action in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's cache.

AnalysisAI

Unauthorized cache deletion in the ThriveDesk WordPress plugin (all versions through 2.1.7) is possible by any authenticated user holding a Subscriber-level role or above, due to a missing capability check on the thrivedesk_clear_cache AJAX action. The root cause is a CWE-862 Missing Authorization flaw in includes/helper.php - any logged-in user can invoke the privileged cache-clearing function without role validation. No public exploit has been identified at time of analysis and no CISA KEV listing exists; real-world impact is bounded to cache disruption and potential performance degradation rather than data loss or code execution.

Technical ContextAI

The ThriveDesk plugin (CPE: cpe:2.3:a:thrivedesk:agentic_help_desk_plugin_for_wordpress_-_live_chat,_ai_chatbot_&_ticketing_-_thrivedesk:*:*:*:*:*:*:*:*) registers a WordPress AJAX handler named thrivedesk_clear_cache, implemented in includes/helper.php at line 238. WordPress AJAX actions are accessible to any authenticated user unless the handler explicitly calls current_user_can() to verify the caller's role or capability. CWE-862 (Missing Authorization) describes precisely this pattern: a function that performs a privileged operation without verifying that the requester holds the necessary capability. Because no such check exists, the authorization boundary between Subscriber and Administrator roles is effectively absent for this specific action.

RemediationAI

Update ThriveDesk to version 2.2.0 or later; the fix is confirmed by the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3512748%40thrivedesk&new=3512748%40thrivedesk. If immediate patching is not feasible, disabling open subscriber registration on the WordPress site removes the most accessible attacker path, since exploitation requires at minimum a subscriber-level account. As an additional compensating control, a Web Application Firewall rule can be configured to block POST requests to wp-admin/admin-ajax.php containing action=thrivedesk_clear_cache from non-administrative roles; note this will break legitimate cache management functionality for authorized users until the plugin is updated. See the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4bc1d4-2f14-4f3e-85ed-8737c56f905c for further detail.