Critical severity · published May 8, 2023
CVE-2023-1650
The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP…
9.8
CVSS
34.4%
EPSS
No
On KEV
Description
The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)34.4% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
Wpbot · Quantumcloud
before 4.4.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-1650
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-1650
Exploit
https://wpscan.com/vulnerability/7d7fe498-0aa3-4fa7-b560-610b42b2abed
More from Wpbot
9.8
CVE-2024-22309
WordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object Injection
9.8
CVE-2023-5533
AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions
8.8
CVE-2023-44993
WordPress ChatBot Plugin <= 4.7.8 is vulnerable to Cross Site Request Forgery (CSRF)
8.1
CVE-2023-5212
AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
8.1
CVE-2023-5241
AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file