Paper/Archive/CVE-2024-13091

CVE-2024-13091

QuantumCloud WPBot Pro Wordpress Chatbot — WPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File Upload

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 58.3.583 × 2011.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcld_wpcfb_file_upload' function in all versions up to, and including, 13.5.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit requires thee ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon plugin.

Affected

ProductAffectedFixed inSource

WPBot Pro Wordpress Chatbot≤ 13.5.4–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/0f9b6979-2662-4d2f-9656-b880dd80832c?source=cve refwpbot.pro