This vulnerability (CWE-434) in Kognetiks Chatbot for WordPress allows unauthenticated attackers to upload files of dangerous types without restriction. The affected versions include all versions up to 2.0.0. The vulnerability has a CVSS 3.1 base score of 10.0, reflecting network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation could allow attackers to upload and execute malicious files on the server hosting the vulnerable WordPress plugin, leading to full system compromise including data theft, data modification, or denial of service. The critical CVSS score reflects the potential for complete loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official Kognetiks communications for updates on fixes.