CVE-2023-51409: WordPress AI Engine Plugin Unauthenticated Arbitrary File Upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS score is 9.8 (critical), exploitation is trivial (unauthenticated, no user interaction), and a public exploit exists, making immediate action necessary.

What it is

The AI Engine: ChatGPT Chatbot WordPress plugin through version 1.9.98 allows unrestricted upload of files with dangerous types. An unauthenticated attacker can upload executable files to the web server, which can lead to remote code execution. The flaw is rated critical with a CVSS score of 9.8.

Impact

An attacker can upload and execute arbitrary code on the server, leading to full site compromise, data theft, or use of the server for further attacks. This can result in complete loss of confidentiality, integrity, and availability.

Attack surface

The vulnerability is reachable over the network without authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). It is exploited through the plugin's file upload functionality.

Exploitation

The CVE is not listed in CISA KEV, but EPSS indicates a high probability of exploitation (63% in 30 days, 99th percentile). A public proof-of-concept exploit is referenced on GitHub, suggesting active exploitation is likely.

What to do

• Update the AI Engine: ChatGPT Chatbot plugin to a version later than 1.9.98 immediately.
• If an update is not possible, disable or remove the plugin until a patch can be applied.
• Implement a web application firewall (WAF) rule to block malicious file upload attempts targeting the plugin.
• Restrict file upload permissions and validate file types on the server side as a defense-in-depth measure.
• Monitor for and remove any suspicious uploaded files, especially those with executable extensions.

Detection

• Monitor web server logs for POST requests to plugin endpoints that may indicate file upload attempts.
• Scan the uploads directory for unexpected files with executable extensions (e.g., .php, .phtml).
• Use file integrity monitoring to detect new or modified files in web-accessible directories.
• Review server logs for requests matching known exploit patterns or user agents associated with the public PoC.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.