CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qc_wp_latest_update_check_pro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create Simple Text Responses to chat queries.
Explanation of Vulnerability in Simple Terms
WPBot Pro contains a missing authorization flaw that allows authenticated users with low privileges to modify data they should not have access to. An attacker with a basic WordPress account can alter chatbot settings or configurations without proper permission checks. The vulnerability affects versions up to 13.5.5 and requires an active WordPress user account to exploit.
What an attacker can do
Modify chatbot settings or data without proper authorization as a low-privilege WordPress user.
Potential impact on your site
Unauthorized users can alter WPBot Pro chatbot configuration, potentially disrupting customer interactions or modifying bot behavior.
Conditions required to exploit
Attacker must have a valid low-privilege WordPress user account; no user interaction required.
Key dates
External resources
Related vulnerabilities
