CVE-2023-5533CWE-862

AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions

Medium · published October 20, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00638 · 49.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-10-20T07:29Z
EPSS history
Timeline
  • 20 OCT 07:29Z
    AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions
    cvelistv5