Arbitrary File Deletion Vulnerability in AI ChatBot Plugin for WordPress

CVE-2023-5212

Summary

The AI ChatBot plugin for WordPress contains a vulnerability that allows authenticated users with subscriber privileges to delete arbitrary files on the server. This flaw, present in versions up to 4.8.9 and also in version 4.9.2, can lead to complete site takeover for affected installations, as well as other sites sharing the same hosting environment. The issue was initially addressed in version 4.9.1 but was later reintroduced and subsequently fixed in 4.9.3.

References