The WPBot Pro Wordpress Chatbot plugin contains a path validation flaw in the qcld_openai_delete_training_file() function that allows an authenticated user with Subscriber-level access or higher to delete any file on the server. This enables an attacker to remove critical configuration files such as wp-config.php, which can immediately result in remote code execution and full compromise of the WordPress installation. The weakness is a classic CWE-73 "Path Traversal" defect.

WPBot Pro Wordpress Chatbot, produced by QuantumCloud, is vulnerable in all releases up to and including version 13.6.2. Any WordPress site that has an affected instance of this plugin installed is at risk.

The vulnerability has a CVSS score of 8.1, indicating high severity. The EPSS score of 2% suggests a low but non‑negligible probability of exploitation in the near term. It is not listed in the CISA KEV catalog, so there are no known publicly documented exploits, but internal attackers or users with legitimate Subscriber access still pose a significant threat. The attack requires valid authentication within the WordPress site, so mitigating the path to user authentication and hardening file permissions are key to reducing risk.