CVE-2024-13091: WPBot Pro WordPress Chatbot RCE Vulnerability

CVE-2024-13091 Overview

CVE-2024-13091 is an arbitrary file upload vulnerability in the WPBot Pro WordPress Chatbot plugin. The flaw exists in the qcld_wpcfb_file_upload function, which lacks file type validation. All plugin versions up to and including 13.5.4 are affected. Unauthenticated attackers can upload arbitrary files to the server, potentially achieving remote code execution. Exploitation requires the ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon plugin to be installed alongside WPBot Pro. The vulnerability is categorized under [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Unauthenticated remote attackers can upload arbitrary files, including PHP web shells, leading to full WordPress site compromise and remote code execution.

Affected Products

WPBot Pro WordPress Chatbot plugin — all versions up to and including 13.5.4
ChatBot Conversational Forms plugin (required dependency for exploitation)
Conversational Form Builder Pro addon plugin (required dependency for exploitation)

Discovery Timeline

2025-01-22 - CVE-2024-13091 published to NVD
2025-01-24 - Last updated in NVD database

Technical Details for CVE-2024-13091

Vulnerability Analysis

The vulnerability resides in the qcld_wpcfb_file_upload function within the WPBot Pro WordPress Chatbot plugin. This function handles file uploads submitted through conversational forms but fails to validate the MIME type, extension, or content of uploaded files.

Because the upload endpoint is reachable without authentication, an attacker can submit a crafted multipart request containing a malicious PHP file. The server stores the file in a web-accessible directory, where it can be executed by issuing an HTTP request to its location. This results in arbitrary code execution under the privileges of the web server process.

The attack requires no user interaction and no privileges. Per the Wordfence Vulnerability Report, exploitation is conditional on the presence of the ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon, which expose the vulnerable upload handler.

Root Cause

The root cause is missing file type validation in the qcld_wpcfb_file_upload function. The handler accepts client-supplied files without enforcing an allowlist of safe extensions or verifying the MIME type against the file content. WordPress upload handlers normally rely on wp_check_filetype_and_ext or similar sanitization, but this routine is absent from the vulnerable code path.

Attack Vector

Attackers send a remote HTTP POST request to the plugin's file upload endpoint with a PHP payload embedded in the file content. After the file is written to the uploads directory, the attacker requests the resulting URL to trigger code execution. No authentication, prior access, or social engineering is required.

No public proof-of-concept exploit code is currently published. Refer to the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-13091

Indicators of Compromise

Unexpected .php, .phtml, .phar, or other executable script files present in the WordPress wp-content/uploads/ directory or plugin-specific upload paths.
HTTP POST requests to chatbot or conversational form upload endpoints from unauthenticated sources, especially with non-standard file extensions in multipart payloads.
Outbound network connections from the web server to attacker-controlled infrastructure following a successful upload.
New or modified WordPress administrator accounts and unexpected scheduled tasks (wp_cron).

Detection Strategies

Inspect web server access logs for POST requests targeting the qcld_wpcfb_file_upload AJAX action or related plugin endpoints.
Run file integrity monitoring across the wp-content/uploads/ tree and alert on any newly written PHP files.
Use a WordPress security scanner or web application firewall capable of identifying CWE-434 arbitrary upload patterns.

Monitoring Recommendations

Centralize WordPress and web server logs in a security data lake and apply correlation rules for upload-followed-by-execution patterns.
Monitor PHP process telemetry for child processes spawning shell interpreters, common indicators of web shell activity.
Track plugin inventory and version state across all WordPress instances to identify systems running WPBot Pro 13.5.4 or earlier.

How to Mitigate CVE-2024-13091

Immediate Actions Required

Update the WPBot Pro WordPress Chatbot plugin to a version newer than 13.5.4 as soon as a patched release is available from the vendor.
Deactivate and remove the WPBot Pro plugin, the ChatBot Conversational Forms plugin, and the Conversational Form Builder Pro addon until patching is confirmed.
Audit wp-content/uploads/ and related plugin directories for unauthorized PHP files and remove any web shells found.
Rotate WordPress administrator credentials and review user accounts for unauthorized additions.

Patch Information

Review the WPBot vendor site for patched releases addressing CVE-2024-13091. Apply updates across all WordPress instances running the affected plugin. The Wordfence Vulnerability Report tracks remediation status.

Workarounds

Block public access to the chatbot upload endpoint at the web application firewall or reverse proxy layer.
Configure the web server to deny PHP execution within wp-content/uploads/ using directives such as php_admin_flag engine off in Apache or equivalent location blocks in Nginx.
Restrict allowed upload file extensions through a WordPress hardening plugin until the vendor patch is applied.

bash

# Nginx configuration example: deny PHP execution in WordPress uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php5|php7|pht)$ {
    deny all;
    return 403;
}