{"basis":"claimed","id":"CVE-2024-6845","name":"SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure","vendorProject":"Unknown","product":"Chatbot with ChatGPT WordPress","publishedAt":"2024-09-25","cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"exploited":null,"epss":{"score":0.01104,"percentile":0.65768,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"no_history","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2024-11-12","daysToRule":48},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure","description":"The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key","cwes":[],"vendors":[{"vendor":"cloudflare","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2024-11-12","firstIsNew":true,"daysToRule":48,"daysAtMost":null,"freePlan":false,"claims":[{"id":"33c941170f9b9f93c554ef54ac9617969c389f2dc33c349a4bafa8e5e0ab0c35","cve_id":"CVE-2024-6845","vendor":"f5","product":"Attack signatures","rule_id":"200009323","rule_name":"WordPress SmartSearchWP OpenAI Key Disclosure","change":"new","default_action":null,"published_on":"2024-11-12","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200009323 \"WordPress SmartSearchWP OpenAI Key Disclosure\" (Information Leakage, risk Medium), systems: WordPress. References: CVE-2024-6845.","first_seen_at":"2026-11-02T21:00:26.849Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:16:33.988Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2024-6845","templatePath":"http/cves/2024/CVE-2024-6845.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/wp-json/wdgpt/v1/api-key","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"passed","templateId":"CVE-2024-6845","templatePath":"http/cves/2024/CVE-2024-6845.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/","status":200,"blocked":false,"rules":[]},{"method":"POST","path":"/wp-json/wdgpt/v1/api-key","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}