AVID-2026-R1302

Description

WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability (CVE-2023-51409)

Details

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98.

Reason for inclusion in AVID: CVE-2023-51409 describes an unauthenticated arbitrary file upload in the WordPress AI Engine plugin (AI Engine: ChatGPT Chatbot). This is a software vulnerability in a component used to deploy AI features on websites, which constitutes a software supply chain element in AI deployments. The flaw enables improper file uploads with potential remote code execution, impacting security and safety of AI-powered web deployments. The report provides explicit vulnerability behavior, affected version range, and CVE reference.

References

Affected or Relevant Artifacts

Developer: OpenAI
Deployer: OpenAI
Artifact Details:

Type	Name
System	AI Engine: ChatGPT Chatbot

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score	10.0
Base Severity	🔴 Critical
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	NONE
Scope	CHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-434	CWE-434 Unrestricted Upload of File with Dangerous Type

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-04-12
Version: 0.3.3
AVID Entry