{"id":"CVE-2026-115245","kind":"vulnerability","aliases":["CVE-2026-115245"],"related":[],"title":"Chat AI with Dispatcher WordPress plugin: unauthenticated upload of PHP files","description":"The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution.","summary":"The Chat AI with Dispatcher WordPress plugin before 2.4 checks uploaded files only by a client-supplied content type, which an attacker can fake. An unauthenticated attacker can therefore upload a PHP file and run code on the server.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chat-ai-with-dispatcher","package","php","wordpress"],"not_affected_if":["plugin-not-installed","version-2.4-or-later"],"how_to_check":"- Check the installed version of the Chat AI with Dispatcher plugin in the WordPress admin under Plugins.\n- Look for uploaded `.php` files in the plugin's upload directories under `wp-content/uploads`.","fix":"- Chat AI with Dispatcher plugin: move to `2.4` or later.","status":"open","published_at":"2026-10-29T06:17:19+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:47+00:00","updated_at":"2026-10-29T06:54:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T06:54:47Z","model":"claude-haiku-5-5","output":{"fix":"- Chat AI with Dispatcher plugin: move to `2.4` or later.","reach":"internet","title":"Chat AI with Dispatcher WordPress plugin: unauthenticated upload of PHP files","impact":"high","summary":"The Chat AI with Dispatcher WordPress plugin before 2.4 checks uploaded files only by a client-supplied content type, which an attacker can fake. An unauthenticated attacker can therefore upload a PHP file and run code on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","php","chat-ai-with-dispatcher"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary PHP code on the web server","analyst_note":"Confirm the affected version range and the exact upload endpoint from the NVD entry or the plugin's advisory; the sources give only 'before 2.4'.","how_to_check":"- Check the installed version of the Chat AI with Dispatcher plugin in the WordPress admin under Plugins.\n- Look for uploaded `.php` files in the plugin's upload directories under `wp-content/uploads`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-2.4-or-later"],"who_is_affected":"Sites running the Chat AI with Dispatcher WordPress plugin before version 2.4 are exposed, because the upload endpoint accepts files without checking their real type. The sources do not say whether the upload path needs any non-default setting, so the plugin being installed and active is the main condition. Sites that do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000718,"input_tokens":4117,"output_tokens":613,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115245':14A,17A '-2026':13A,16A '2.4':34B,74C 'ai':2A,20B,28B,68C 'allow':91C 'arbitrari':96C 'attack':48B,53B,93C 'chat':1A,19B,27B,67C 'chat-ai-with-dispatch':18B 'check':35B 'client':42B,87C 'client-suppli':41B,86C 'code':62B,105C 'content':44B,89C 'cve':12A,15A 'dispatch':4A,22B,30B,70C 'execut':106C 'fake':50B 'file':11A,37B,59B,80C,97C 'includ':98C 'lead':102C 'packag':23B 'php':10A,24B,58B,99C 'plugin':6A,32B,72C 'proper':77C 'reli':81C 'remot':104C 'run':61B 'server':65B 'spoofabl':85C 'suppli':43B,88C 'therefor':55B 'type':45B,90C 'unauthent':7A,52B,92C 'upload':8A,36B,56B,79C,95C 'valid':78C 'wordpress':5A,25B,31B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Chat AI with Dispatcher WordPress plugin before version 2.4 are exposed, because the upload endpoint accepts files without checking their real type. The sources do not say whether the upload path needs any non-default setting, so the plugin being installed and active is the main condition. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115245","severity":null,"published_at":"2026-10-29T06:17:19+00:00","modified_at":"2026-10-29T06:17:19+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}