CVE-2026-87916
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions. This allows unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
Risk Assessment
An unauthenticated attacker can obtain personal data of all chat visitors, which is a serious privacy breach and may result in legal consequences (GDPR). The risk to reputation and compliance is high.
Recommendation
Update the plugin to version 8.6.0 or later to fix the missing capability and nonce checks.
Other vulnerabilities in WPBot
See all- CVE-2026-87918Medium
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers. This allows unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
- CVE-2026-14185Medium
The WPBot WordPress plugin before version 8.2.0 does not perform capability or nonce checks in one of its retrieval-augmented-generation settings handlers. This allows authenticated users with subscriber-level access to modify the plugin's configuration.
Original NVD description (English source)
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS