This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Arbitrary File Upload via missing validation in `kalrav_upload_file` AJAX action. π₯ **Consequences**: Leads to Remote Code Execution (RCE).β¦
π‘οΈ **Root Cause**: CWE-434 (Unrestricted Upload of File with Dangerous Type). The plugin fails to validate file types during the upload process, allowing dangerous extensions.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: WordPress Plugin **Kalrav AI Agent**. **Versions**: 2.3.3 and earlier. **Vendor**: irisideatechsolutions.
Q4What can hackers do? (Privileges/Data)
π **Privileges**: Unauthenticated access required. π **Data**: Full server control via RCE. High impact on Confidentiality, Integrity, and Availability (CVSS: 9.8).
Q5Is exploitation threshold high? (Auth/Config)
β‘ **Threshold**: LOW. No authentication (PR:N) or user interaction (UI:N) needed. Network accessible (AV:N) with Low complexity (AC:L). Easy to exploit.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Exploit**: YES. Public PoC available on GitHub (d0n601/CVE-2025-13374). Active exploitation is likely given the low barrier to entry.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for `kalrav-ai-agent.php` version <= 2.3.3. Check if the `kalrav_upload_file` AJAX endpoint exists and lacks file type validation logic.
Q8Is it fixed officially? (Patch/Mitigation)
π οΈ **Fix**: Update to the latest version of Kalrav AI Agent. Check vendor release notes for patched versions. Official references provided in WordFence and WP Trac.
Q9What if no patch? (Workaround)
π§ **Workaround**: Disable the plugin if not needed. Implement WAF rules to block requests to `kalrav_upload_file` AJAX action. Restrict file upload types at the server level.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: CRITICAL. CVSS 9.8 + Unauthenticated + Public PoC = Immediate action required. Patch or mitigate within 24-48 hours.