CSRF vulnerability in AIKCT Engine Chatbot plugin <= 1.6.2
A cross-site request forgery vulnerability in the AIKCT Engine Chatbot WordPress plugin allows tricking logged-in users into unintended actions. The vulnerability was disclosed in December 2024 and patched in version 1.6.3.
What happened
The AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot Plugin for WordPress versions 1.6.2 and earlier contains a Cross Site Request Forgery (CSRF) vulnerability identified as CVE-2024-54306.
Logged-in users can be tricked into performing unintended actions through malicious links, crafted pages, or forms. The vulnerability was patched in version 1.6.3.
Reported impact
The CVSS score for this vulnerability is 4.3, classified as low severity. The vulnerability requires user interaction and the privileged user to perform an action.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.