CVE-2025-3812: WPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcldopenaideletetrainingfile() function in all versions up to, and including, 13.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3812?
CVE-2025-3812 has a critical severity due to its potential for arbitrary file deletion.
How do I fix CVE-2025-3812?
To mitigate CVE-2025-3812, upgrade the WPBot Pro plugin to version 13.6.3 or higher.
Who is affected by CVE-2025-3812?
Authenticated users of WPBot Pro versions up to and including 13.6.2 are vulnerable to CVE-2025-3812.
What type of vulnerability is CVE-2025-3812?
CVE-2025-3812 is classified as an arbitrary file deletion vulnerability.
What function is responsible for the vulnerability in CVE-2025-3812?
The qcld_openai_delete_training_file() function is responsible for the vulnerability in CVE-2025-3812.