CVE-2023-5533

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-55345.4The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is d CVE-2023-55357.8Use After Free in GitHub repository vim/vim prior to v9.0.2010.CVE-2023-55366.4A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate CVE-2023-55374.3The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to CVE-2023-55386.1The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and incl CVE-2023-55398.8A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.CVE-2023-55408.8A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.CVE-2023-55416.1The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.CVE-2023-55424.3Students in "Only see own membership" groups could see other students in the group, which should be hidden.CVE-2023-55433.3When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This CVE-2023-55445.4Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.CVE-2023-55455.3H5P metadata automatically populated the author with the user's username, which could be sensitive information.