CVE-2024-29100 CRITICAL

CVE-2024-29100: WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability

Vendor Jordy Meow
Product AI Engine: ChatGPT Chatbot
Weakness CWE-434 · Unrestricted file upload
Published March 28, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.

Explanation of Vulnerability in Simple Terms

02Summary

The AI Engine: ChatGPT Chatbot plugin allows authenticated administrators to upload files without proper validation. An attacker with admin access can upload malicious files to compromise the site. The vulnerability affects versions up to 2.1.4 and requires high-level privileges to exploit.

What an attacker can do

03Attacker Capabilities

Upload malicious files to the site and execute arbitrary code.

Potential impact on your site

04Site Impact

A compromised admin account can lead to full site takeover and data breach.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

March 28, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-45444 WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability CVE-2026-58480 Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments CVE-2026-48939 Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15 CVE-2026-61424 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 CVE-2026-14270 Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings