CVE-2026-32579

CVE-2026-32579 is an unauthenticated arbitrary file upload flaw (CWE-434) in the Kognetiks Chatbot plugin for WordPress, versions 2.4.9 and earlier. A remote attacker can upload files without logging in and without any user interaction, because the plugin does not properly restrict dangerous file types. Successful exploitation can fully compromise confidentiality, integrity, and availability, with impact beyond the plugin’s own scope, and is rated CVSS 3.1 10.0 (critical). WordPress sites running those plugin versions are affected. It is not in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Update Kognetiks Chatbot to a release newer than 2.4.9 as soon as the vendor or WordPress.org publishes a fixed version. Until then, deactivate the plugin on internet-facing sites and review the WordPress uploads directory for unexpected files. No public exploit is known, but the unauthenticated critical rating means this should be patched before waiting for exploitation reports.