Login Sign Up

CVE-2024-32700

10.0 CRITICAL
Remote Code Execution

📋 TL;DR

This vulnerability allows attackers to upload arbitrary files to WordPress sites running the vulnerable Kognetiks Chatbot plugin. Attackers can upload malicious files like PHP shells to gain remote code execution. All WordPress sites using Kognetiks Chatbot versions up to 2.0.0 are affected.

💻 Affected Systems

Products:
  • Kognetiks Chatbot for WordPress
Versions: All versions up to and including 2.0.0
Operating Systems: Any OS running WordPress
Default Config Vulnerable: ⚠️ Yes
Notes: Affects all WordPress installations with the vulnerable plugin enabled.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:
  1. Review the CVE details at NVD
  2. Check vendor security advisories for your specific version
  3. Test if the vulnerability is exploitable in your environment
  4. Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise leading to data theft, ransomware deployment, or website defacement.

🟠

Likely Case

Remote code execution allowing attackers to install backdoors, steal data, or pivot to other systems.

🟢

If Mitigated

File uploads blocked or restricted to safe types only.

🌐 Internet-Facing: HIGH - WordPress sites are typically internet-facing and vulnerable to unauthenticated attacks.
🏢 Internal Only: MEDIUM - Internal WordPress sites could still be compromised via internal attackers or phishing.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: CONFIRMED
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploit requires no authentication and is trivial to execute with publicly available tools.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.0.1 or later

Vendor Advisory: https://patchstack.com/database/vulnerability/chatbot-chatgpt/wordpress-kognetiks-chatbot-for-wordpress-plugin-2-0-0-arbitrary-file-upload-vulnerability

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins > Installed Plugins. 3. Find Kognetiks Chatbot. 4. Click 'Update Now' if available. 5. If no update appears, manually download version 2.0.1+ from WordPress.org and replace plugin files.

🔧 Temporary Workarounds

Disable Plugin

all

Temporarily disable the vulnerable plugin until patched.

wp plugin deactivate chatbot-chatgpt

Restrict File Uploads via .htaccess

linux

Block PHP file execution in upload directories.

<FilesMatch "\.(php|php5|php7|phtml|phar)$">
  Order Allow,Deny
  Deny from all
</FilesMatch>

🧯 If You Can't Patch

  • Remove the Kognetiks Chatbot plugin completely from your WordPress installation.
  • Implement web application firewall (WAF) rules to block file uploads to the vulnerable endpoint.

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Installed Plugins for Kognetiks Chatbot version 2.0.0 or earlier.

Check Version:

wp plugin get chatbot-chatgpt --field=version

Verify Fix Applied:

Verify plugin version is 2.0.1 or later in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

  • POST requests to /wp-content/plugins/chatbot-chatgpt/upload.php with file uploads
  • Unexpected PHP file creation in upload directories

Network Indicators:

  • HTTP POST requests with file uploads to chatbot plugin endpoints
  • Unusual outbound connections from web server

SIEM Query:

source="web_access.log" AND (uri_path="/wp-content/plugins/chatbot-chatgpt/upload.php" OR uri_path LIKE "%/chatbot-chatgpt/%") AND http_method="POST" AND content_type LIKE "%multipart/form-data%"

📊 Metadata

CVE ID: CVE-2024-32700
CVSS v3 Score: 10.0 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-434
Published: May 14, 2024
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-32700, you might also want to check these:

CVE-2024-52490 10.0

This vulnerability allows attackers to upload arbitrary files, including web shells, to Pathomation ...

Same vulnerability type (CWE-434)
CVE-2024-43160 10.0

CVE-2024-43160 is an unauthenticated arbitrary file upload vulnerability in the BerqWP WordPress plu...

Same vulnerability type (CWE-434)
CVE-2024-8940 10.0

CVE-2024-8940 is a critical unrestricted file upload vulnerability in Scriptcase version 9.4.019 tha...

Same vulnerability type (CWE-434)