Arbitrary File Upload Vulnerability in Kognetiks Chatbot for WordPress Plugin

CVE-2024-4560

9.8CRITICAL

Key Information

Vendor: Kognetiks
Status: Kognetiks Chatbot For WordPress
Vendor: CVE Published:; 14 May 2024

Summary

The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the chatbot_chatgpt_upload_file_to_assistant function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers, with to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected Version(s)

Kognetiks Chatbot for WordPress <= 1.9.9

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
May 14, 2024
Disclosed
May 10, 2024
Vulnerability Reserved.
May 6, 2024

Collectors

NVD DatabaseMitre Database

Credit

Francesco Carlucci