What’s Vulnerable › Vulnerabilities
CVE-2024-6845: SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-09-25 · updated 2026-06-17
- Weakness: CWE-862
Description
The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key
Affected products
- Chatbot with ChatGPT WordPress: before 2.4.6 — fixed in 2.4.6
How to fix
Upgrade to a fixed version: Chatbot with ChatGPT WordPress 2.4.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-6845 or the next vulnerability affects your stack