CVE-2023-5241 CRITICAL

CVE-2023-5241: AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

Vendor Quantumcloud
Product WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
Weakness CWE-22 · Path traversal
Published October 19, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

What the vulnerability does

01Description

The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on the server resulting in potential DoS when appended to critical files such as wp-config.php.

Key dates

02Disclosure timeline

October 19, 2023 CVE published
April 8, 2026 Record updated