A critical Arbitrary File Deletion vulnerability has been identified in the WordPress AI ChatBot plugin. This vulnerability could allow a malicious actor to delete files from your website. If core files are deleted from your website, it could cause your site to break and stop functioning.

This vulnerability was discovered and responsibly reported by Marco Wotschka & Chloe Chamberland.

The vulnerability is an Arbitrary File Deletion vulnerability that occurs in the chatbot.php file. The vulnerability allows an attacker to exploit a flaw in the way that the plugin handles user input to delete files on the website.


The vulnerability has a CVSS 3.1 score of 9.6, which is considered to be critical. This means that the vulnerability is very likely to be exploited and could have a severe impact on the affected system.

Affected Versions:

All versions of the ChatBot plugin prior to 4.9.1 are affected by this vulnerability.


An attacker who successfully exploits this vulnerability could:

  • Delete critical files from your website, rendering it unusable.
  • Delete sensitive files, such as user passwords or configuration files.
  • Cause your website to break and stop functioning.


Users of the ChatBot plugin are strongly advised to undertake the following actions:

  1. Update the Plugin: Do not hesitate; to immediately update the WordPress AI ChatBot Plugin to the latest version, specifically version 4.9.1 or a higher release. This update contains critical security fixes to rectify the Arbitrary File Deletion vulnerability.
  2. Regularly Update Plugins: Beyond this immediate update, make it standard practice to regularly update all WordPress plugins and themes to their latest versions. Keeping website components up to date is a fundamental security measure.
  3. Enhance Security Measures: Consider implementing additional security measures, such as web application firewalls (WAFs), robust authentication protocols, and routine security audits. A comprehensive security strategy is essential to minimize potential exploitation attempts.