Threats tagged 'ghsa-xqfh-qj3w-mr75'

AI ChatBot for WooCommerce WordPress plugin versions before 4.8.4 have an improper access control vulnerability. The plugin does not perform authorization or nonce checks on a specific AJAX action, allowing unauthenticated users to misuse the site owner's stored third-party API key. This can lead to unauthorized requests billed to the owner's account and, if enabled, unauthorized retrieval of indexed knowledge-base content.