CVE-2024-6846
published 2024-09-05CVE-2024-6846: The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and…
PriorityP338medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EXPLOIT
EPSS
1.26%
66.0th percentile
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| webdigit | chatbot_with_chatgpt | < 2.4.5 | 2.4.5 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
nuclei·CVSS 5.3
CVE-2024-6846 [MEDIUM] SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs.
Template:
id: CVE-2024-6846
info:
name: SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
author: s4e-io
severity: medium
description: |
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs.
impact: |
Unauthenticated attackers can delete error and chat logs, potentially destroying evidence of attacks or system issues.
remediation: |
Update SmartSearchWP plugin to version 2.4.5 or later to address the unauthorized log purge vulnerability.
reference:
- https:/
No writeups or analysis indexed.
2024-09-05
Published