CVE-2023-5533 MEDIUM

CVE-2023-5533: AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions

Vendor Quantumcloud
Product WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
Weakness CWE-862 · Missing authorization
Published October 20, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users.

Key dates

02Disclosure timeline

October 20, 2023 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-63034 WordPress Page View Count plugin <= 2.9.0 - Settings Change vulnerability CVE-2024-38740 WordPress Packlink PRO shipping module plugin <= 3.4.6 - Broken Access Control vulnerability CVE-2024-38769 WordPress Arconix Shortcodes plugin <= 2.1.11 - Broken Access Control vulnerability CVE-2025-68023 WordPress Addonify – Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerability CVE-2025-14173 Perfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion