CVE-2024-6845

The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

1.10% chance of exploitation in the next 30 days, 63th percentile

Nuclei

medium · CWE-862

Published

2024-09-25

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/cfaaa843-d89e-42d4-90d9-988293499d26/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6845.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-6843
• CVE-2024-6846
• CVE-2024-6842
• CVE-2024-6847
• CVE-2024-6830
• CVE-2024-6848