5.3
Medium
CVE-2026-87916 The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists…
Description
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPBot 8.4 | 8.4.9 → < 8.6.0 | 8.6.0 |
Other CVEs of WPBot
The 5 CVEs of WPBot →
CVE-2026-87959
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI…
5.4
Medium
CVE-2026-87918
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions…
5.3
Medium
CVE-2026-14189
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using…
3.8
Low
CVE-2026-14185
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its…
4.3
Medium