CVE-2024-6845 — SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure

CVE-2024-6845

SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure PUBLISHED

Description (CNA)

The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key

Affected (CNA)

Vendor / product	Versions
Unknown / Chatbot with ChatGPT WordPress	affected 0 before 2.4.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/cfaaa843-d89e-42d4-90d9-988293499d26/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.