CVE-2024-0451: AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback
The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openaifilelistcallback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to list files existing in a linked OpenAI account.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0451?
CVE-2024-0451 has a high severity due to unauthorized data access vulnerabilities.
How do I fix CVE-2024-0451?
To fix CVE-2024-0451, update the AI ChatBot plugin to version 5.3.5 or later.
Who is affected by CVE-2024-0451?
CVE-2024-0451 affects all versions of the AI ChatBot plugin up to and including 5.3.4.
What type of attack does CVE-2024-0451 enable?
CVE-2024-0451 enables authenticated attackers with subscriber-level access to exploit unauthorized data access.
What function is vulnerable in CVE-2024-0451?
The vulnerable function in CVE-2024-0451 is the openai_file_list_callback due to a missing capability check.