PT-2025-1975 · WordPress · Wpbot Pro

Brokenac Ignore · Published 2025-01-22 · Updated 2025-01-22 · CVE-2024-12879

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPBot Pro Wordpress Chatbot plugin for WordPress versions up to, and including, 13.5.5

Description The issue allows authenticated attackers with Subscriber-level access and above to create Simple Text Responses to chat queries due to a missing capability check on the qc wp latest update check pro function. This enables unauthorized modification of data.

Recommendations For versions up to, and including, 13.5.5, consider disabling the qc wp latest update check pro function until a patch is available to prevent unauthorized data modification. Restrict access to the chat query response creation feature to minimize the risk of exploitation. Avoid using the affected function for creating Simple Text Responses until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-12879

Affected Products

Wpbot Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-12879 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12879 · Vendor Advisory
• https://twitter.com/CVEnew/status/1881937865711427680 · Twitter Post
• https://wpbot.pro · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/91427e3e-fedb-407e-8af6-8f4411a4166a?source=cve · Note
• https://t.me/cvedetector/16077 · Telegram Post
• https://t.me/cvenotify/108181 · Telegram Post