Paper/Archive/CVE-2023-5533

CVE-2023-5533

quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services — AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 50.6.506 × 2010.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users.

Affected

ProductAffectedFixed inSource

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services≤ 4.8.9–CNA

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services4.9.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Wordfence (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refwordfence.com/threat-intel/vulnerabilities/id/a9db002f-ff41-493a-87b1-5f0b4b07cfc2?source=cve refplugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail=