CVE-2023-5534

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
5.4MEDIUM
EPSS
0.1%
top 81.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Quantumcloud Wpbot
Timeline
PublishedOct 20

Description

The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

▶NVDquantumcloud/wpbot4.8.9+1

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions↗2023-10-20
▶
GHSA
GHSA-8cfv-g2mq-hrpw: The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4↗2023-10-20
▶
CVE-2023-5534 (MEDIUM CVSS 5.4) | The AI ChatBot plugin for WordPress | cvebase.io