CVE-2024-6846medium

CVE-2024-6846: medium-severity vulnerability in Chatbot with ChatGPT WordPress

SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge

Published · Updated

28Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 5.3epss 1.3%
exploitation probability
1.3%top 31% of all CVEs
observed exploitation
nono source reports it
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Chatbot with ChatGPT WordPress
Related CVEs — Chatbot with ChatGPT WordPress

In the same product, most dangerous first.

CVE-2024-6845MEDIUMSmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key DisclosureEPSS 1.1%CVE-2024-6847CRITICALSmartSearch WP <= 2.4.4 - Unauthenticated SQLiEPSS 0.7%CVE-2024-6843MEDIUMSmartSearch WP <= 2.4.4 - Unauthenticated Stored XSSEPSS 0.4%
References
https://wpscan.com/vulnerability/d48fdab3-669c-4870-a2f9-6c39a7c25fd8/