CVE-2026-115245
Chat AI with Dispatcher permits unauthenticated arbitrary file upload
Chat AI with Dispatcher maintainers · Chat AI with Dispatcher WordPress plugin
First documented disclosure · Review checkpoint
Summary
Upload validation trusts a client-supplied content type.
Severity and exploitation evidence
Critical · 9.8/10 · CVSS 3.1. Severity source.
Exploitation not established: WPScan marks the finding verified, but withholds its PoC until November 27. CISA ADP lists exploitation as none; this is not proof exploitation cannot occur.
Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.
How the weakness works
A spoofed MIME type can allow arbitrary uploaded files, including PHP.
Conditions required
Network access to the vulnerable upload handler; no login is required.
Potential impact
Potential remote code execution through uploaded executable files.
Affected versions and configurations
Before 2.4.
Fix and mitigation status
2.4.
Practical next steps
Upgrade to a supported fixed version; disable the plugin if immediate patching is unavailable and prevent execution in upload storage.
Operating lesson
Validate file content and extensions server-side, separately from client-declared MIME types.
Evidence and limits
WPScan disclosed October 27; the authority record appeared October 29. CVSS3.1 9.8 comes from CISA ADP, not a published WPScan score. No victim incident established.
Sources
- WPScan original advisory
Primary source ·
- WPScan CNA with CISA ADP assessment
Primary source ·