CVE-2024-6846

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

1.25% chance of exploitation in the next 30 days, 67th percentile

Nuclei

medium

Published

2024-09-05

Updated

2025-08-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d48fdab3-669c-4870-a2f9-6c39a7c25fd8/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-6846.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-6845
• CVE-2024-6847
• CVE-2024-6843
• CVE-2024-6848
• CVE-2024-6842
• CVE-2024-6850