CVE-2024-13091: WPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File Upload
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcldwpcfbfileupload' function in all versions up to, and including, 13.5.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit requires thee ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon plugin.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13091?
CVE-2024-13091 has a high severity due to its ability to allow arbitrary file uploads by unauthenticated attackers.
How do I fix CVE-2024-13091?
To fix CVE-2024-13091, update the WPBot Pro WordPress Chatbot plugin to a version higher than 13.5.4.
Who is affected by CVE-2024-13091?
CVE-2024-13091 affects all versions of the WPBot Pro plugin up to and including version 13.5.4.
What impact does CVE-2024-13091 have?
CVE-2024-13091 allows attackers to upload arbitrary files, potentially leading to data breaches or further exploitation of the site.
Is exploitability of CVE-2024-13091 limited to specific user roles?
CVE-2024-13091 can be exploited by unauthenticated users, meaning anyone can potentially exploit this vulnerability.