WordPress Plugin Vulnerabilities

AI Engine: ChatGPT Chatbot < 1.9.99 - Unauthenticated Arbitrary File Upload

Description

The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'rest_upload' function in all versions up to, and including, 1.9.98. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
ai-engine
Fixed in 1.9.99

References

CVE
CVE-2023-51409
URL
https://patchstack.com/database/vulnerability/ai-engine/wordpress-ai-engine-plugin-1-9-98-unauthenticated-arbitrary-file-upload-vulnerability

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
15d9073d-9259-479e-af5d-9102c3a1e0e9

Timeline

Publicly Published
2024-01-09 (about 2 years ago)
Added
2024-01-17 (about 2 years ago)
Last Updated
2024-01-17 (about 2 years ago)

Other

Published
Title
Published
2025-12-11
Title
Infility Global < 2.14.43 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2024-08-12
Title
Media Library Assistant < 3.19 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
Published
2024-10-17
Title
WP REST API FNS <= 1.0.0 - Unauthenticated Arbitrary File Upload
Published
2025-05-07
Title
BEAF < 4.6.11 - Authenticated (Admin+) Arbitrary File Upload
Published
2016-04-23
Title
Tevolution < 2.3.0 - Unrestricted File Upload