CVE-2023-5241: Directory Traversal in AI ChatBot

An attacker exploiting CVE-2023-5241 can leverage the directory traversal vulnerability to append malicious code, specifically "<?php", to existing files on the WordPress server. This is particularly dangerous when targeting critical files like wp-config.php. By injecting this code, an attacker can disrupt the WordPress installation, potentially leading to a complete denial of service. The ability to append code to core configuration files could also allow for further exploitation, although the immediate impact is primarily DoS. The vulnerability's ease of exploitation, combined with the potential for widespread impact, makes it a significant security concern.

1. Reserved2023-09-27
2. Published2023-10-19
3. Modified2025-06-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-5241 is to immediately upgrade AI ChatBot for WordPress to version 4.9.3 or later. If upgrading is not immediately feasible, consider implementing a temporary workaround by restricting file upload permissions for subscriber-level users. Review server access logs for any suspicious file modification attempts. While a WAF might offer some protection, it's unlikely to be effective against this type of vulnerability without specific rules tailored to the qcldopenaiuploadpagetrainingfile function. After upgrading, verify the fix by attempting to upload a file with a malicious filename (e.g., ../../../../wp-config.php<?php) and confirming that the upload is rejected.

Active installs

6KPopular

Plugin rating

4.7

Requires WordPress

4.6+

Compatible up to

7.0

Requires PHP

5.6+