Is CVE-2024-32729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-32729 being exploited in the wild.

How severe is CVE-2024-32729?

High severity, with a CVSS score of 7.5, published 17 June 2026.

Which products and versions are affected?

QuantumCloud Conversational Forms for ChatBot up to 1.1.8.

Is there a fix for CVE-2024-32729?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-32729 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-32729?

Check whether you run QuantumCloud Conversational Forms for ChatBot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-32729: QuantumCloud Conversational Forms for ChatBot path traversal

CVE-2024-32729 · Severity: high · CVSS 7.5 · Published 2026-06-17

QuantumCloud Conversational Forms for ChatBot is a WordPress plugin used to create interactive forms for website chatbots. A security flaw in this plugin allows an attacker to download sensitive files from the web server without needing to log in. This could lead to the exposure of configuration files, database credentials, or other private site data, potentially compromising the entire website.

Vendors: QuantumCloud.

Quick answers

Is CVE-2024-32729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-32729 being exploited in the wild.
How severe is CVE-2024-32729?: High severity, with a CVSS score of 7.5, published 17 June 2026.
Which products and versions are affected?: QuantumCloud Conversational Forms for ChatBot up to 1.1.8.
Is there a fix for CVE-2024-32729?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-32729 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-32729?: Check whether you run QuantumCloud Conversational Forms for ChatBot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the QuantumCloud Conversational Forms for ChatBot plugin for WordPress in versions up to and including 1.1.8. The flaw stems from improper limitation of pathnames, allowing an unauthenticated remote attacker to perform arbitrary file downloads. By sending a specially crafted request, an attacker can traverse the directory structure and access files outside of the intended directory, such as wp-config.php. This vulnerability is exploitable over the network without user interaction. The issue has been addressed in version 1.2.0.

Affected products

QuantumCloud Conversational Forms for ChatBot up to 1.1.8

Timeline

2024-01-29: other: Reported by Yudistira Arya
2024-04-22: advisory: Initial disclosure by Patchstack
2026-06-17: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.