CVE-2024-13091
Published: 22 January 2025
Summary
CVE-2024-13091 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wpbot Wpot. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The WPBot Pro WordPress Chatbot plugin is affected by an arbitrary file upload vulnerability (CWE-434) in the qcld_wpcfb_file_upload function. All versions through 13.5.4 are impacted because the function lacks file type validation, allowing unauthenticated attackers to place arbitrary files on the server. Exploitation also requires the separate ChatBot Conversational Forms plugin and Conversational Form Builder Pro addon; the issue carries a CVSS 3.1 score of 9.8.
Unauthenticated remote attackers can upload malicious files and achieve remote code execution on the affected WordPress site. No authentication or user interaction is required, and the attack can be performed over the network with low complexity.
The EPSS score for this CVE rose from a low baseline to a peak of 0.2281 with a current value of 0.1024, indicating that exploitation interest increased after disclosure. Wordfence and the vendor site at wpbot.pro are the primary sources of advisory information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51332
Vulnerability details
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcld_wpcfb_file_upload' function in all versions up to, and including, 13.5.4. This makes it possible for unauthenticated attackers to…
more
upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit requires thee ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon plugin.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing WordPress plugin directly enables web shell deployment for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely patching or updating of the WPBot Pro plugin beyond version 13.5.4 directly remediates the arbitrary file upload vulnerability due to missing file type validation.
System-wide information input validation enforces file type checks at upload points, directly addressing the lack of validation in the qcld_wpcfb_file_upload function.
Malicious code protection mechanisms scan and block execution of dangerous files uploaded via the vulnerable plugin function.