CVE-2024-6846
SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs
The Chatbot with ChatGPT WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wdgpt_purge_chat_logs and wdgpt_purge_error_logs functions in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to purge logs.
*Credits:
Bob Matyas, WPScan
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-07-17 CVE Reserved
- 2024-08-14 CVE Published
- 2024-09-05 First Exploit
- 2024-09-09 EPSS Updated
- 2024-09-12 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-862: Missing Authorization
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://wpscan.com/vulnerability/d48fdab3-669c-4870-a2f9-6c39a7c25fd8 | 2024-09-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Unknown Search vendor "Unknown" | Chatbot With ChatGPT WordPress Search vendor "Unknown" for product "Chatbot With ChatGPT WordPress" | < 2.4.5 Search vendor "Unknown" for product "Chatbot With ChatGPT WordPress" and version " < 2.4.5" | en |
Affected
| ||||||