Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Kognetiks Chatbot for WordPress lets anyone upload files

CVE-2026-32579 · published 13 days ago
Summary

The Kognetiks Chatbot for WordPress plugin (versions up to 2.4.9) does not require login to accept file uploads. An attacker could place malicious files on your site, potentially taking control or disrupting operations. Upgrade to the latest version or remove the plugin if you cannot update.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
kognetiks kognetiks chatbot for wordpress <= 2.4.9
Original advisory text
WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published6 Oct 2026
Updated15 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-32579 · NVD
CVE-2026-32579 · MITRE
Track software like this
Free during beta