The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs
Date: 2024-09
Affected: webdigit/chatbot_with_chatgpt
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-6846
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs


Mitigations:

Architectural layers (MAESTRO):