Arbitrary File Upload Vulnerability in WPBot Pro WordPress Chatbot Plugin

CVE-2024-13091

Summary

The WPBot Pro WordPress Chatbot plugin is susceptible to an arbitrary file upload vulnerability owing to inadequate file type validation in the 'qcld_wpcfb_file_upload' function. This issue is present in all versions up to and including 13.5.4. Consequently, unauthenticated attackers can exploit this vulnerability to upload arbitrary files onto the server of the affected site. This incident could potentially facilitate remote code execution, posing significant security risks. It is important to note that the exploit requires the presence of the ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon plugin.

References