Description
The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversations.
Published: 2025-10-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized File Upload and Conversation Deletion
Action: Apply Patch
AI Analysis

Impact

The Kognetiks Chatbot WordPress plugin permits attackers without authentication to bypass authorization checks and upload a restricted set of files that the plugin deems safe. In addition, an unauthenticated attacker can invoke the delete function to erase all stored conversation data. This missing capability verification is a classic unauthorized access flaw, classified as CWE‑285, allowing data modification and loss of user interactions, which may compromise confidentiality or disrupt service continuity.

Affected Systems

WordPress installations that use the Kognetiks Chatbot plugin, versions 2.3.5 and earlier, are impacted by this vulnerability.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation. The flaw is not currently listed in the CISA KEV catalog, meaning it has not been widely observed in the wild. Attackers can exploit the issue unauthenticated through web requests to the plugin’s upload or conversation‑erase endpoints, and doing so requires only internet access to the affected WordPress site.

Generated by OpenCVE AI on April 27, 2026 at 23:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Kognetiks Chatbot plugin to the latest version that includes the missing capability check fix.
  • Configure the web server or a security plugin to block unauthenticated access to the plugin’s upload and conversation‑deletion endpoints, thereby preventing unauthorized use of these functions.
  • Scan the site for any unexpected or unauthenticated uploaded files and remove them, and restore critical conversation data from backups if available.

Generated by OpenCVE AI on April 27, 2026 at 23:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Oct 2025 20:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 20 Oct 2025 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Kognetiks
Kognetiks chatbot
Wordpress
Wordpress wordpress
Vendors & Products Kognetiks
Kognetiks chatbot
Wordpress
Wordpress wordpress

Sat, 18 Oct 2025 07:45:00 +0000

Type Values Removed Values Added
Description The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversations.
Title Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing
Weaknesses CWE-285
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Kognetiks Chatbot
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:40:26.905Z

Reserved: 2025-10-03T12:13:35.865Z

Link: CVE-2025-11256

cve-icon Vulnrichment

Updated: 2025-10-20T17:37:28.978Z

cve-icon NVD

Status : Deferred

Published: 2025-10-18T08:15:33.660

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-11256

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-27T23:45:15Z

Weaknesses