WordPress Plugin Vulnerabilities

Kognetiks Chatbot for WordPress < 2.0.1 - Unauthenticated Arbitrary File Upload

Description

The plugin is vulnerable to arbitrary file uploads due to missing file type validation, allowing unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
chatbot-chatgpt
Fixed in 2.0.1

References

CVE
CVE-2024-32700
URL
https://patchstack.com/database/vulnerability/chatbot-chatgpt/wordpress-kognetiks-chatbot-for-wordpress-plugin-2-0-0-arbitrary-file-upload-vulnerability

Miscellaneous

Original Researcher
LVT-tholv2k
Verified
No
WPVDB ID
57ade042-3d16-494e-91f9-6abde069f2bd

Timeline

Publicly Published
2024-05-13 (about 1 year ago)
Added
2024-05-15 (about 1 year ago)
Last Updated
2024-05-17 (about 1 year ago)

Other

Published
Title
Published
2025-01-07
Title
4ECPS Web Forms <= 0.2.18 - Unauthenticated Arbitrary File Upload
Published
2024-11-15
Title
Backup and Staging by WP Time Capsule < 1.22.22 - Unauthenticated Arbitrary File Upload
Published
2025-05-16
Title
STAGGS < 2.12.0 - Unauthenticated Arbitrary File Upload
Published
2014-08-01
Title
Verve Meta Boxes 1.2.8 - Shell Upload
Published
2014-08-01
Title
dagda - Arbitrary File Upload