The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to list files existing in a linked OpenAI account.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Quantumcloud |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-16246 | The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to list files existing in a linked OpenAI account. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 12 May 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Quantumcloud
Quantumcloud wpbot |
|
| Weaknesses | CWE-862 | |
| CPEs | cpe:2.3:a:quantumcloud:wpbot:*:*:*:*:free:wordpress:*:* | |
| Vendors & Products |
Quantumcloud
Quantumcloud wpbot |
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2024-08-01T18:04:49.911Z
Reserved: 2024-01-11T23:38:14.865Z
Link: CVE-2024-0451
Vulnrichment
Updated: 2024-08-01T18:04:49.911Z
NVD
Status : Analyzed
Published: 2024-05-22T04:15:09.130
Modified: 2025-05-12T13:58:55.033
Link: CVE-2024-0451
Redhat
No data.
OpenCVE Enrichment
No data.