CVE-2024-6845

SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure

Medium · published September 25, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
65.5
In the wild
Unconfirmed
What it is

The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01104 · 65.5th percentile
Published
2024-09-25T06:00Z
EPSS history
Timeline
  • 25 SEP 06:00Z
    SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure
    cvelistv5