/Vulnerability Library

WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection

CVE-2023-5204
Verified

Description

ChatBot plugin for WordPress up to 4.8.9 contains a sql_injection caused by insufficient escaping and lack of preparation on the $strid parameter, letting unauthenticated attackers extract sensitive data, exploit requires no authentication.

Severity

Critical

CVSS Score

9.8

Exploit Probability

7%

Published Date

February 12, 2026

Template Author

shivam kamboj

CVE-2023-5204.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2023-5204
CWE ID:
cwe-89

References

https://nvd.nist.gov/vuln/detail/CVE-2023-5204https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/chatbot/chatbot-489-unauthenticated-sql-injection-via-qc-wpbo-search-responsehttps://plugins.trac.wordpress.org/browser/chatbot/trunk/qcld-wpwbot-search.php?rev=2957286#L177

Remediation Steps

Update to the latest version of the plugin that addresses this vulnerability, or apply security patches provided by the vendor.