Kognetiks Chatbot EUVD-2026-93240

No special conditions beyond the plugin being installed and active - remote unauthenticated exploitation against default configurations of Kognetiks Chatbot for WordPress versions 2.4.9 and earlier, requiring no authentication (PR:N), no user interaction (UI:N), and only network reachability to the WordPress site (AV:N). The description does not name a non-default setting or feature toggle as a prerequisite, so the primary limiting factors are simply whether the vulnerable plugin version is installed/enabled and whether the upload directory permits PHP execution; sites that have upgraded past the fixed version or that block PHP execution in upload directories are not exploitable for RCE.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the most dangerous possible profile: network-reachable, low attack complexity, no privileges, and no user interaction. Combined with CWE-434 (unrestricted file upload) in a web-facing WordPress plugin, this realistically means an unauthenticated remote attacker can upload a PHP webshell and achieve remote code execution - hence the C:H/I:H/A:H full-impact rating and the vendor's 10.0 score (driven partly by S:C/scope-change). The signals do not conflict: description ('Unauthenticated Arbitrary File Upload') and CVSS (PR:N) agree that no authentication is needed. The tempering factors are the MISSING exploitation-maturity signals: there is no EPSS probability provided, no CISA KEV listing, and no public POC identified in the input. Thus the inherent/theoretical risk is critical, but there is currently no evidence of active exploitation or weaponized exploit code - the priority is driven by exploitability potential rather than observed in-the-wild activity. Patch urgency remains high because unauthenticated file-upload flaws in WordPress plugins are historically fast to be weaponized once a plugin is identified as vulnerable.

A remote, unauthenticated attacker locates a WordPress site running Kognetiks Chatbot for WordPress <= 2.4.9 and sends a crafted request to the plugin's file-upload handler to upload a malicious PHP file into a web-accessible directory. The attacker then requests that uploaded file directly to execute arbitrary code, gaining a webshell and effective control of the site. No public exploit code was identified in the provided data, but the AV:N/AC:L/PR:N/UI:N profile makes this trivially scriptable once the vulnerable endpoint is known.