5.4
Moyenne
CVE-2026-87959 The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI…
Description
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WPBot 8.7 | 8.7.2 → < 8.7.6 | 8.7.6 |
Autres CVE de WPBot
Les 5 CVE de WPBot →
CVE-2026-87918
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions…
5.3
Moyenne
CVE-2026-87916
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists…
5.3
Moyenne
CVE-2026-14189
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using…
3.8
Faible
CVE-2026-14185
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its…
4.3
Moyenne