Live › vulnerability › CVE-2026-115245
The Chat AI with Dispatcher WordPress plugin before 2.4 checks uploaded files only by a client-supplied content type, which an attacker can fake. An unauthenticated attacker can therefore upload a PHP file and run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Chat AI with Dispatcher WordPress plugin before version 2.4 are exposed, because the upload endpoint accepts files without checking their real type. The sources do not say whether the upload path needs any non-default setting, so the plugin being installed and active is the main condition. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
.php files in the plugin's upload directories under wp-content/uploads.2.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-115245")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.