Vulnerability · Published May 8, 2023 · Assigned by WPScan

CVE-2023-1650ChatBot < 4.4.7 - Unauthenticated PHP Object Injection

Critical 9.8

In plain English

A critical-severity unsafe deserialization in AI ChatBot from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 34.4% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)34.4%top 1.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog

Affected products (as reported)

Vendor	Product	Versions
Unknown	AI ChatBot	0 – before 4.4.7

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/7d7fe498-0aa3-4fa7-b560-610b42b2abed exploit, vdb-entry, technical-description