CyberRota Analysis
AI-GeneratedThe Chat Widget plugin for WordPress versions prior to 1.8.2 is vulnerable due to inadequate validation of file submissions to its public response endpoint, allowing unauthenticated users to upload arbitrary files to the server's uploads directory. While this vulnerability does not enable code execution or stored XSS, it can lead to excessive disk consumption and potential misuse of storage for unwanted content. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.