CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to update GTP assistants.
Explanation of Vulnerability in Simple Terms
The Kognetiks Chatbot plugin for WordPress versions 2.1.7 and earlier does not properly check user permissions before allowing certain actions. An attacker can modify data on the site without authentication. The vulnerability requires only network access and no user interaction.
What an attacker can do
Modify site data without logging in.
Potential impact on your site
Unauthorized changes to site content or settings via the chatbot plugin.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
