CVE-2026-115245 PUBLISHED

Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload

Assigner: WPScan
Reserved: 22.10.2026 Published: 29.10.2026 Updated: 29.10.2026

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution.

Product Status

Vendor Unknown
Product Chat AI with Dispatcher
Versions Default: unaffected
  • affected from 0 to 2.4 (excl.)

Credits

  • Enrico Marcolini finder
  • Claudio Marchesini finder
  • Dottor Marc finder
  • WPScan coordinator

References

Problem Types

  • CWE-434 Unrestricted Upload of File with Dangerous Type CWE