Kognetiks Chatbot WordPress Plugin Unauthorized File Upload and Data Modification Vulnerability

A vulnerability exists in the Kognetiks Chatbot plugin for WordPress, in all versions through 2.3.5. The issue arises from a lack of proper capability checks, allowing unauthenticated users to upload certain safe file types and delete conversations. This unauthorized data modification could be exploited by attackers to disrupt user interactions or manipulate chatbot data.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of chatbot conversations and potentially allow for the upload of limited safe files, which could be used to further manipulate the chatbot's behavior or data.

Remediation

Users are advised to update the Kognetiks Chatbot plugin to version 2.3.6 or a later patched version.