VulnerabilityAnalyzed

CVE-2024-6846

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs

MEDIUM 5.3EPSS 1.25%

Does this matter?

Lower severity and a low EPSS score (1.25%). Track it; it rarely justifies an emergency change on its own.

Description

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 1.25% probability · 68th percentile
CISA KEV: Not listed
Affected: webdigit/chatbot with chatgpt
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/d48fdab3-669c-4870-a2f9-6c39a7c25fd8/Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.