PT-2024-37900 · WordPress · Chatbot With Chatgpt Wordpress Plugin

Bob Matyas · Published 2024-09-04 · Updated 2025-05-16 · CVE-2024-6846

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chatbot with ChatGPT WordPress plugin versions prior to 2.4.5

Description The issue concerns improper access controls in the REST Route Handler of the Chatbot with ChatGPT WordPress plugin. This allows an unauthenticated user to purge error and chat logs due to the plugin not validating access on some REST routes.

Recommendations For versions prior to 2.4.5, upgrade the Chatbot with ChatGPT WordPress plugin to version 2.4.5 or later to mitigate the risk of remote exploit. As a temporary workaround, consider restricting access to the REST routes until the plugin is updated.

Exploit

Fix

Related Identifiers

CVE-2024-6846

Affected Products

Chatbot With Chatgpt Wordpress Plugin

References · 9

• 🔥 https://wpscan.com/vulnerability/d48fdab3-669c-4870-a2f9-6c39a7c25fd8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6846 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6846 · Vendor Advisory
• https://t.me/cvenotify/122675 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1831645228379292075 · Twitter Post
• https://t.me/cvedetector/4888 · Telegram Post
• https://twitter.com/CVEnew/status/1831578311773782272 · Twitter Post
• https://t.me/cvenotify/93279 · Telegram Post
• https://twitter.com/oktsec/status/1831606692351545640 · Twitter Post