CVE-2023-5241
CriticalSummary
The AI ChatBot for WordPress plugin versions up to 4.8.9 and 4.9.2 contains a Directory Traversal vulnerability in the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on the server, potentially causing a Denial of Service (DoS) when critical files like wp-config.php are modified.
Risk Assessment
The risk involves potential website unavailability due to corruption of key configuration files, requiring manual administrator intervention to restore functionality.
Recommendation
It is recommended to immediately update the AI ChatBot plugin to the latest available version that fixes this vulnerability. Also, restrict permissions for users with the subscriber role.
Original NVD description (English source)
The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on the server resulting in potential DoS when appended to critical files such as wp-config.php.