CVE-2024-4560 is a critical vulnerability in the Kognetiks Chatbot for WordPress plugin, affecting all versions up to and including 1.9.9. The vulnerability arises from the lack of file type validation in the chatbot_chatgpt_upload_file_to_assistant function, enabling unauthenticated attackers to upload arbitrary files to the server. This unrestricted file upload can potentially lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented.

The vulnerability allows unauthenticated attackers to upload arbitrary files to the affected WordPress site, which may enable remote code execution. This can lead to full compromise of the server hosting the plugin, including data theft, modification, or service disruption. The critical CVSS score of 9.8 reflects the high likelihood and impact of exploitation. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict file upload capabilities or disable the vulnerable plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.