CVE-2023-5212criticalCWE-22

CVE-2023-5212: fallo crítico en quantumcloud WPBot – AI ChatBot for Live…

AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

48Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 9.6epss 2.0%
The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosting account. Version 4.9.1 originally addressed the issue, but it was reintroduced in 4.9.2 and fixed again in 4.9.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Productos afectados
quantumcloud · WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — quantumcloud WPBot – AI ChatBot for Live…

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-5204CRITICALAI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_responseEPSS 7.8%CVE-2023-5241CRITICALAI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_fileEPSS 2.6%CVE-2023-5254MEDIUMAI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_userEPSS 0.9%CVE-2026-13731HIGHWPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' ParameterEPSS 0.9%CVE-2023-5533MEDIUMAI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actionsEPSS 0.6%CVE-2026-83593HIGHWPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' ParameterEPSS 0.5%