Description
The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Published: 2026-01-24
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The Kalrav AI Agent plugin for WordPress is vulnerable because the kalrav_upload_file AJAX action lacks file type validation, allowing an attacker to upload arbitrary files. This flaw can lead to remote code execution on the site. The weakness corresponds to CWE-434, Missing File Type Validation.

Affected Systems

The issue impacts the Kalrav AI Agent plugin from irisideatechsolutions for WordPress, with all releases up to and including version 2.3.3 vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8, indicating critical severity, and an EPSS score of less than 1%, suggesting a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is unauthenticated via a public AJAX endpoint, meaning any visitor can perform the exploit.

Generated by OpenCVE AI on April 21, 2026 at 23:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • If an official update is available for Kalrav AI Agent, upgrade to the latest version that addresses the file type validation issue.
  • If an upgrade is not immediately possible, disable the kalrav_upload_file AJAX endpoint or restrict uploads to authenticated users only.
  • Implement a server‑side file type whitelist or temporarily disable file uploads in the WordPress installation as a fallback measure.

Generated by OpenCVE AI on April 21, 2026 at 23:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Jan 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 26 Jan 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Sat, 24 Jan 2026 07:45:00 +0000

Type Values Removed Values Added
Description The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Title Kalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:56:00.083Z

Reserved: 2025-11-18T19:07:07.043Z

Link: CVE-2025-13374

cve-icon Vulnrichment

Updated: 2026-01-26T15:35:11.286Z

cve-icon NVD

Status : Deferred

Published: 2026-01-24T08:16:05.173

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-13374

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T00:00:03Z

Weaknesses