WPBot Pro WordPress Chatbot Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the WPBot Pro WordPress Chatbot plugin, affecting all versions through 13.6.2. The issue arises from inadequate file path validation in the 'qcld_openai_delete_training_file()' function. This vulnerability enables authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server. Deleting certain files, such as 'wp-config.php', could easily result in remote code execution.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files on the server, with the potential for remote code execution if a sensitive file is removed.

Remediation

Users are advised to update the WPBot Pro WordPress Chatbot plugin to version 13.7.0 or a newer patched version.