CVE-2024-0453: AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback
The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openaifiledeletecallback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete files from a linked OpenAI account.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0453?
CVE-2024-0453 is considered a medium severity vulnerability due to its potential for data modification by authenticated attackers.
How do I fix CVE-2024-0453?
To fix CVE-2024-0453, update the AI ChatBot plugin for WordPress to version 5.3.5 or later, which includes the necessary capability checks.
What type of attacks are possible with CVE-2024-0453?
CVE-2024-0453 allows authenticated attackers to potentially modify data by bypassing security checks.
Who is affected by CVE-2024-0453?
CVE-2024-0453 affects users of the WordPress AI ChatBot plugin, specifically versions up to and including 5.3.4.
Is CVE-2024-0453 exploitable without authentication?
No, CVE-2024-0453 requires authentication, meaning only authenticated users can exploit the vulnerability.