CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.4.6. This is due to insufficient validation of user-supplied URLs in the PDF processing functionality. This makes it possible for unauthenticated attackers to make the WordPress server perform HTTP requests to arbitrary destinations via the mxchat_handle_chat_request AJAX action.
Explanation of Vulnerability in Simple Terms
The MxChat WordPress plugin versions 2.4.6 and earlier contain a server-side request forgery vulnerability. An unauthenticated attacker can make the plugin send HTTP requests to internal or external systems on the site's behalf. This could expose sensitive data from internal services or be used to attack other systems accessible from the web server.
What an attacker can do
Make the site send HTTP requests to internal or external systems without authorization.
Potential impact on your site
Attackers can probe internal services, exfiltrate data, or attack other systems reachable from your server.
Conditions required to exploit
No authentication or user interaction required; attacker needs only network access to the site.
Key dates
External resources
Related vulnerabilities
