CVE-2025-26932: 
WordPress vulnerability analysis and mitigation

The ChatBot WordPress plugin developed by QuantumCloud contains a Local File Inclusion (LFI) vulnerability affecting versions up to and including 6.3.5. The vulnerability was discovered and reported on February 9, 2025, and was publicly disclosed on February 23, 2025 (Patchstack).

The vulnerability is classified as a Local File Inclusion (LFI) with a CVSS score of 7.5, indicating a moderate to high severity. The vulnerability type is categorized under OWASP Top 10 A3: Injection. The issue requires Contributor-level privileges to exploit (Patchstack).

This vulnerability could allow a malicious actor to include local files of the target website and display their contents on the screen. Particularly sensitive files containing credentials, such as database configuration files, could potentially be exposed, leading to complete database compromise depending on the system configuration (Patchstack).

The vulnerability has been patched in version 6.3.6 of the ChatBot plugin. Users are advised to update to version 6.3.6 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins as an additional security measure (Patchstack).