CVE-2023-1650

Deeper analysis

The AI ChatBot WordPress plugin before version 4.4.7 is affected by a deserialization flaw (CWE-502) that processes untrusted user input supplied through cookies. An unauthenticated AJAX action directly invokes PHP unserialize on this cookie data, enabling PHP Object Injection whenever a usable gadget chain exists in the WordPress installation or its active plugins.

An attacker can therefore send a crafted cookie to the exposed AJAX endpoint and trigger arbitrary object instantiation and method invocation on the target site. Successful exploitation yields full control over the application context, allowing impacts such as remote code execution, data disclosure, or privilege escalation, consistent with the CVSS 9.8 rating that reflects network-accessible attack with no authentication or user interaction required.

The referenced WPScan advisory identifies the issue in versions prior to 4.4.7 and implies that updating to 4.4.7 or later removes the vulnerable code path. The associated EPSS score rose from a low baseline to a peak of 0.4881 (current value 0.2603), indicating increased exploitation interest after public disclosure.