CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-5533 – AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions
https://notcve.org/view.php?id=CVE-2023-5533
The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users. El complemento AI ChatBot para WordPress es vulnerable al uso no autorizado de acciones AJAX debido a la falta de comprobaciones de capacidad en las funciones correspondientes en versiones hasta la 4.8.9 y la 4.9.2 incluida. Esto hace posible que atacantes no autenticados realicen algunas de aquellas acciones destinadas a usuarios con mayores privilegios. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/a9db002f-ff41-493a-87b1-5f0b4b07cfc2?source=cve • CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-5534 – AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions
https://notcve.org/view.php?id=CVE-2023-5534
The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. El complemento AI ChatBot para WordPress es vulnerable a Cross-Site Request Forgery en versiones hasta la 4.8.9 y 4.9.2 incluida. Esto se debe a una validación nonce faltante o incorrecta en las funciones correspondientes. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/846bd929-45cd-4e91-b232-ae16dd2b12a0?source=cve • CWE-352: Cross-Site Request Forgery (CSRF) •