CVE-2024-0451: 
WordPress vulnerability analysis and mitigation

The AI ChatBot plugin for WordPress versions 5.3.4 and earlier contains a vulnerability related to unauthorized access of data due to missing capability checks. The vulnerability was disclosed on May 22, 2024, and has been assigned CVE-2024-0451. The issue was discovered by security researcher Francesco Carlucci (Patchstack).

The vulnerability is classified as a Broken Access Control issue with a CVSS severity score of 5.0 (Low). The security flaw stems from missing authorization, authentication, or nonce token checks in certain functions, potentially allowing unprivileged users to execute higher privileged actions. The vulnerability affects users with Subscriber-level privileges (Patchstack).

The vulnerability has been assessed as having a low severity impact and is considered unlikely to be exploited. The broken access control issue could potentially allow unauthorized users to perform actions beyond their intended privilege level (Patchstack).

The vulnerability requires Subscriber-level access to the WordPress installation for exploitation. Given its low severity rating, the likelihood of successful exploitation in the wild is considered minimal (Patchstack).

The vulnerability has been fixed in version 5.3.6 of the AI ChatBot plugin. Users are advised to update to version 5.3.6 or later to remediate the security issue (Patchstack).