CVE-2024-0452: AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback
The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openaifileuploadcallback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files to a linked OpenAI account.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0452?
CVE-2024-0452 is classified with a medium severity due to unauthorized data modification risks for authenticated attackers.
How do I fix CVE-2024-0452?
To fix CVE-2024-0452, update the AI ChatBot plugin to version 5.3.5 or later, where the capability check is implemented.
Who is affected by CVE-2024-0452?
Users of the AI ChatBot plugin for WordPress on versions up to 5.3.4 are affected by CVE-2024-0452.
What type of attack does CVE-2024-0452 facilitate?
CVE-2024-0452 facilitates unauthorized modification of data by authenticated attackers with subscriber-level access.
What function is vulnerable in CVE-2024-0452?
The vulnerable function in CVE-2024-0452 is openai_file_upload_callback due to a missing capability check.