WordPress Plugin Vulnerabilities

Kognetiks Chatbot < 2.5.0 - Unauthenticated Arbitrary File Upload

Description

The Kognetiks Chatbot plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.9. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Affects Plugins

Plugin icon
chatbot-chatgpt
Fixed in 2.5.0

References

CVE
CVE-2026-32579
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff7d2d5-d1f7-43e4-a174-d62d0b1a3d0b

Miscellaneous

Original Researcher
Nguyen Dinh Hai (HaiND)
Verified
No
WPVDB ID
fefcac64-4c2c-4c33-b896-4df2a5f4ce52

Timeline

Publicly Published
2026-10-04 (about 12 days ago)
Added
2026-10-08 (about 8 days ago)
Last Updated
2026-10-16 (about 8 hours ago)

Other

Published
Title
Published
2024-07-08
Title
Default Thumbnail Plus <= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload
Published
2024-06-14
Title
FooEvents for WooCommerce < 1.19.21 - Improper Authorization to (Contributor+) Arbitrary File Upload
Published
2016-10-14
Title
WP Marketplace - Arbitrary File Upload
Published
2022-09-07
Title
Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload
Published
2025-11-17
Title
Pie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Upload