PT-2024-16347 · Kognetiks · Kognetiks Chatbot For Wordpress

Tieu Pham Trong Nhan

·

Published

2024-11-12

·

Updated

2024-11-18

·

CVE-2024-10530

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Kognetiks Chatbot for WordPress plugin versions up to, and including, 2.1.7
Description The Kognetiks Chatbot for WordPress plugin has a vulnerability that lets users change data without permission due to a missing capability check on the add new assistant() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to create new GTP assistants.
Recommendations For versions up to, and including, 2.1.7, update to the latest version to mitigate risks. As a temporary workaround, consider restricting access to the add new assistant() function until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-10530

Affected Products

Kognetiks Chatbot For Wordpress