What the vulnerability does
01Description
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcld_wpcfb_file_upload' function in all versions up to, and including, 13.5.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit requires thee ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon plugin.
Explanation of Vulnerability in Simple Terms
02Summary
WPBot Pro contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files to the site without validation. An attacker can exploit this over the network without user interaction to upload malicious files, potentially gaining control of the WordPress installation. All versions up to 13.5.4 are affected.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the site and execute code on the server.
Potential impact on your site
04Site Impact
Complete compromise of the WordPress site; attacker can run code, steal data, or modify content.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 21, 2025
CVE published
April 8, 2026
Record updated
