CVE-2024-6847 SmartSearch WP <= 2.4.4 - Unauthenticated SQLi

2024-08-2006:00:03

WPScan

github.com

smartsearch wp

sql injection

unauthenticated

AI Score

7.9

Confidence

Low

EPSS

Percentile

9.5%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Chatbot with ChatGPT WordPress",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.4.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:smartsearchwp:chatbot_with_chatgpt_wordpress:*:*:*:*:*:*:*:*"
    ],
    "vendor": "smartsearchwp",
    "product": "chatbot_with_chatgpt_wordpress",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.4.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]