What the vulnerability does
01Description
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcld_openai_delete_training_file() function in all versions up to, and including, 13.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
02Summary
WPBot Pro versions up to 13.6.2 contain a vulnerability allowing authenticated users to modify site data or disrupt service. An attacker with a low-privilege account can alter chatbot settings, configurations, or related database records without proper access controls. This affects the integrity and availability of the chatbot functionality and potentially dependent site features.
What an attacker can do
03Attacker Capabilities
Modify or delete chatbot data and settings, or disrupt chatbot service availability.
Potential impact on your site
04Site Impact
Chatbot configuration can be altered or destroyed by low-privilege users; service disruption possible.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (subscriber or contributor level).
Key dates
06Disclosure timeline
May 17, 2025
CVE published
April 8, 2026
Record updated
