CVE-2024-13091 is a critical unrestricted file upload vulnerability in the WPBot Pro Wordpress Chatbot plugin affecting all versions up to 13.5.4. The vulnerability stems from the lack of file type validation in the 'qcld_wpcfb_file_upload' function, enabling unauthenticated attackers to upload arbitrary files to the server. This can potentially lead to remote code execution. Exploitation requires the ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon to be installed alongside WPBot Pro. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

An attacker can upload arbitrary files without authentication, which may lead to remote code execution on the affected WordPress site. This compromises the confidentiality, integrity, and availability of the server hosting the plugin. The vulnerability affects all versions of WPBot Pro up to 13.5.4 when used with the required additional plugins. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the WPBot Pro plugin and the related ChatBot Conversational Forms and Conversational Form Builder Pro addon plugins if possible. Monitor vendor channels for updates and apply patches promptly once available.