The WPBot AI ChatBot plugin for WordPress suffers from an improper access control vulnerability (CWE-284) due to the absence of a capability check in the openai_file_upload_callback function. This flaw permits authenticated users with minimal privileges (subscriber-level and above) to upload files to the linked OpenAI account, potentially modifying data without authorization. The vulnerability affects all plugin versions up to and including 5.3.4. The CVSS v3.1 base score is 5.0, indicating medium severity. No patch or official remediation guidance has been provided yet.

An attacker with subscriber-level access or higher can exploit this vulnerability to upload files to the linked OpenAI account, resulting in unauthorized modification of data. This could compromise the integrity of data managed through the plugin. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to file uploads in the plugin. Avoid granting unnecessary privileges to low-level authenticated users.