CVE-2026-32579

waiting for further signals

EUVD-2026-93240 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Kognetiks Chatbot for WordPress >= n/a, <= 2.4.9

CWE-434 Unrestricted Upload of File with Dangerous Type

ETK-2026-749, permanent identifier

cvss10.0cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

15d 09h 41msince last run

57mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+1h36m

+4h

+6h

+8h

+10h

+12h

description

Kognetiks Chatbot for WordPress versions through 2.4.9 are affected. A remote party without an account may be able to upload files to a site where the vulnerable plugin is installed and publicly reachable.

mitigation

Deactivate the chatbot-chatgpt plugin on installations running 2.4.9 or earlier until a corrected release is available. If it must remain enabled, limit public access to the affected WordPress site to reduce unauthenticated exposure.

check

exploit

automation

–

auth required

EPSS

0.49%40th percentile

agent run time

57m

cve.org record, t = 0

2026-10-06 08:34Z

Δ to public poc

–

Δ to kev

–

outcome

No artifact: an exploit or check was attempted but could not be produced at this moment.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-06 08:34Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-32579

this entry in the feed

GET /api/v1/feed/CVE-2026-32579

{
  "etk_id": "ETK-2026-749",
  "cve_id": "CVE-2026-32579",
  "display_id": "CVE-2026-32579",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-93240",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated file upload in Kognetiks Chatbot for WordPress",
  "summary": "Kognetiks Chatbot for WordPress versions through 2.4.9 are affected. A remote party without an account may be able to upload files to a site where the vulnerable plugin is installed and publicly reachable.",
  "mitigation": "Deactivate the chatbot-chatgpt plugin on installations running 2.4.9 or earlier until a corrected release is available. If it must remain enabled, limit public access to the affected WordPress site to reduce unauthenticated exposure.",
  "vendor": "kognetiks",
  "product": "Kognetiks Chatbot for WordPress",
  "affected": [
    {
      "affected_notes": [
        ">= n/a, <= 2.4.9"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "chatbot-chatgpt",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0049,
  "epss_percentile": 0.4064,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 57.4173481,
  "t0_at": "2026-10-06T08:34:06.232000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-06T08:34:06.232000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T08:34:06.232000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32579"
    }
  }
}

published 2026-10-06 09:12Z
last change 2026-10-21 18:49Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.