Chat AI with Dispatcher: arbitrary file upload (CVE-2026-115245)
A vulnerability, CVE-2026-115245 (CVSS 9.8), was published for the Chat AI with Dispatcher WordPress plugin. It validates uploaded files only by a client-supplied content type, which can be spoofed.
Checked in Shield: no
Who is affected
WordPress sites running Chat AI with Dispatcher before version 2.4. The attacker does not need to be authenticated; uploading PHP files can lead to remote code execution.
How to check
In the WordPress admin open Plugins and find Chat AI with Dispatcher. If the version is below 2.4, the site is affected. It is also worth looking for unexpected PHP files in upload directories.
How to fix
A fix is available: version 2.4. Update the plugin. If you cannot update right away, deactivate the plugin until you do.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the issue is exploited in the wild is not disclosed yet; the source is the NVD entry.
