CVE-2023-1650

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: May 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-16515.4The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settin CVE-2023-16527.1A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could all CVE-2023-16547.8Denial of Service in GitHub repository gpac/gpac prior to 2.4.0.CVE-2023-16557.8Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.CVE-2023-16567.5Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connecto CVE-2023-16606.1The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated use CVE-2023-16615.4The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post met CVE-2023-16635.3Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The roo CVE-2023-16646.5A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse CVE-2023-16659.8Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.CVE-2023-16669.8A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. This vulnerabilit CVE-2023-16676.5A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cau