This vulnerability in the Kognetiks Chatbot for WordPress plugin permits unauthenticated users to upload any file to the target server. Because the plugin does not validate the file type or check for dangerous content, an attacker can place a malicious script or web shell, enabling remote code execution and full compromise of the WordPress site. The weakness matches CWE‑434, which describes unvalidated or insufficient file uploads. Based on the description, it is inferred that the attacker could upload arbitrary files via the plugin's upload interface.

The flaw affects the Kognetiks Chatbot for WordPress plugin provided by kognetiks. All releases through version 2.4.9 are vulnerable; any installation of 2.1 through 2.4.9 should be considered compromised.

The CVSS score of 10 marks this flaw as critical, and because it is unauthenticated, any user on the Internet can exploit it. The EPSS score of 0.00486 indicates a very low, but non‑zero, probability of exploitation but the lack of an attempt to enter the KEV catalog does not reduce the likelihood of exploitation. Based on the description, it is inferred that any unauthenticated internet user can exploit this flaw via the plugin’s file‑handling endpoint, enabling arbitrary code execution. Attackers can simply upload a malicious file through the plugin’s file‑handling endpoint, resulting in arbitrary code execution. Immediate patching is required to eliminate the risk.