CVE-2024-10530mediumCWE-862

CVE-2024-10530: falha de média gravidade em Kognetiks Chatbot for WordPress

Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Addition

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Kognetiks Chatbot for WordPress

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.4%
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the add_new_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to create new GTP assistants.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
kognetiks · Kognetiks Chatbot for WordPress
CVEs relacionadas — Kognetiks Chatbot for WordPress

No mesmo produto, das mais perigosas para as menos.

CVE-2024-4560CRITICALKognetiks Chatbot for WordPress <= 1.9.9 - Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant FunctionEPSS 0.9%CVE-2024-10529MEDIUMKognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant DeletionEPSS 0.5%CVE-2024-10531MEDIUMKognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant UpdateEPSS 0.5%CVE-2026-32579CRITICALWordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-10684MEDIUMKognetiks Chatbot for WordPress <= 2.1.7 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-11256MEDIUMKognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation ErasingEPSS 0.4%