CVE-2025-11256CWE-285

CVE-2025-11256

Medium · published October 18, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversations.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-285 · Improper Authorization
Published
2025-10-18T12:15Z
References (3)
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3380313%40chatbot-chatgpt&new=3380313%40chatbot-chatgpt&sfp_email=&sfph_mail= · [email protected]https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3380317%40chatbot-chatgpt&new=3380317%40chatbot-chatgpt&sfp_email=&sfph_mail= · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8fe389-ff44-4be3-889b-0006977f4f3c?source=cve · [email protected]
EPSS history
Timeline
  • 18 OCT 07:26Z
    Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing
    cvelistv5