CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete GTP assistants.
Explanation of Vulnerability in Simple Terms
The Kognetiks Chatbot plugin for WordPress versions 2.1.7 and earlier does not properly check user permissions before allowing certain actions. An attacker can modify data or settings without authentication. Update to a version newer than 2.1.7 to resolve this issue.
What an attacker can do
Modify plugin data or settings without logging in to the site.
Potential impact on your site
Unauthorized changes to chatbot configuration or data could disrupt service or expose sensitive information.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
