CVE-2023-51409 Exploited in the Wild — AI Engine: ChatGPT Chatbot

Vendor	Product	Version	Status
ai_engine_project	ai_engine	0.0.1 to <= 1.9.98	Affected
Jordy Meow	AI Engine: ChatGPT Chatbot ai-engine	n/a to <= 1.9.98 Changed to unaffected at 1.9.99	Affected

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Source	Added
The Shadowserver First	2024-04-12 13:15 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-51409.yaml	Jun 02, 2025

Virtual Patch

Compensating WAF rules to help reduce exposure to this CVE. Rule content and deployable vendor exports are available with KEVIntel Enterprise.

Not available

KEVIntel does not currently have a virtual patch for this CVE. When available, KEVIntel virtual patches ship as deployable ModSecurity, Cloudflare, and AWS WAF rules.

Enterprise feature. Virtual patch rule content and deployable vendor exports (ModSecurity, Cloudflare, AWS WAF) are available to KEVIntel Enterprise users.

Request Enterprise Access Learn About Virtual Patches

CVSS Scores

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2024-04-12 13:15:12 UTC · The Shadowserver

Proof of concept available

Recorded 2024-02-22 16:26:57 UTC · GitHub

Weaknesses (CWE)

CWE-434

Unrestricted Upload of File with Dangerous Type

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-51409.yaml	Jun 02, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

RandomRobbieBF/CVE-2023-51409

github · Created 2024-02-22 16:26:57 UTC · 1 stars

AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload

Jordy Meow AI Engine - Unrestricted File Upload

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

2 Jun 2025 14:11 UTC about 1 year ago

2 Jun 2025 14:11 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
12 Apr 2024 13:15 UTC over 2 years ago

12 Apr 2024 13:15 UTC · over 2 years ago

CVE published

Vulnerability disclosed publicly
12 Apr 2024 13:15 UTC over 2 years ago

12 Apr 2024 13:15 UTC · over 2 years ago

Added to KEVIntel KEV Feed

High-confidence, third-party attested exploitation
22 Feb 2024 16:26 UTC over 2 years ago

22 Feb 2024 16:26 UTC · over 2 years ago

Public PoC available

Public proof-of-concept code published
18 Dec 2023 22:41 UTC over 2 years ago

18 Dec 2023 22:41 UTC · over 2 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2023-51409

{
  "cve_id": "CVE-2023-51409",
  "title": "WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload ...",
  "affected_vendor": "Jordy Meow",
  "affected_product": "AI Engine: ChatGPT Chatbot",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 10.0,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2023-51409

At a Glance

Affected Versions

CVE References

Recommended Actions