5.3
Moyenne
CVE-2026-87918 The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions…
Description
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WPBot 8.5 | premières → < 8.5.7 | 8.5.7 |
Autres CVE de WPBot
Les 5 CVE de WPBot →
CVE-2026-87959
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI…
5.4
Moyenne
CVE-2026-87916
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists…
5.3
Moyenne
CVE-2026-14189
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using…
3.8
Faible
CVE-2026-14185
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its…
4.3
Moyenne