CVE-2023-5212 CRITICAL

CVE-2023-5212: AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file

Vendor Quantumcloud
Product WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
Weakness CWE-22 · Path traversal
Published October 19, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

What the vulnerability does

01Description

The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosting account. Version 4.9.1 originally addressed the issue, but it was reintroduced in 4.9.2 and fixed again in 4.9.3.

Key dates

02Disclosure timeline

October 19, 2023 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2019-15980 Cisco Data Center Network Manager Path Traversal Vulnerabilities CVE-2025-27098 Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-mesh CVE-2025-13265 lsfusion platform ZipUtils.java unpackFile path traversal CVE-2026-32711 pydicom: Path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root CVE-2026-24970 WordPress Energox theme <= 1.2 - Arbitrary File Deletion vulnerability