5.3 Medium

CVE-2024-6845 The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint,…

Description

The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key

Affected products and versions

Product	Affected versions	Fixed in
Chatbot with ChatGPT WordPress 2.4	earliest → < 2.4.6	2.4.6
chatbot_with_chatgpt_wordpress 2.4	earliest → < 2.4.6	2.4.6

The 4 CVEs of Chatbot with ChatGPT WordPress →

CVE-2024-6846 The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an… 5.3 Medium CVE-2024-6847 The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it… 9.8 Critical CVE-2024-6843 The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow… 6.1 Medium

Do you use Chatbot with ChatGPT WordPress?

Track this CVE Watch Chatbot with ChatGPT WordPress Check my SBOMs

www.cveye.io/en/cve/CVE-2024-6845

Timeline

Published September 25, 2024
Last modified September 25, 2024

References

wpscan.com wpscan.com

Track this CVE

CVE-2024-6845 The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint,…

Description

Affected products and versions

Other CVEs of Chatbot with ChatGPT WordPress