CVE-2025-11256

MediumCVSS 5.3

Published: 18/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

The Kognetiks Chatbot plugin for WordPress up to version 2.3.5 is vulnerable to unauthorized data modification due to missing capability checks in several functions. This allows unauthenticated attackers to upload limited safe files and erase conversations.

Risk Assessment

The organization may lose conversation data and experience unauthorized changes, impacting data integrity and user trust.

Recommendation

Immediately update the Kognetiks Chatbot plugin to the latest patched version and review logs for unauthorized activities.

Other vulnerabilities in Kognetiks Chatbot

CVE-2026-32579Critical
The vulnerability allows an unauthenticated attacker to perform arbitrary file upload in Kognetiks Chatbot for WordPress up to version 2.4.9.

Original NVD description (English source)

The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversations.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS