EUVD-2026-49076
GHSA-v886-3pxh-g3xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain admin access
-
DeliveryConfigure malicious field identifier in WPBot settings
-
ExploitVisitor triggers search
-
ExecutionCrafted SQL query executes
-
ImpactExtract or modify database content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have administrator-level access to the WordPress site to configure the vulnerable field identifiers. The SQL injection only triggers when a visitor (unauthorized user) performs a search on the front-end. No special configuration beyond default plugin settings is required, but the admin privilege is a hard prerequisite. |
| Impact | CVSS 3.1 base score 3.8 (Low) reflects high privilege requirement and limited impact (low confidentiality and integrity). The EPSS score was not provided, but with a public exploit and no KEV listing, the real-world risk is moderate-exploit code lowers the bar for attackers who gain admin access, but the attack surface is limited to privileged users. SSVC would classify this as active exploitation status unknown but automatable (once admin configures). The low impact and high privileges suggest this is not a widespread emergency unless combined with privilege escalation. No conflicting signals; data is consistent. |
| Exploit ScenarioDerived | An attacker who gains administrator credentials to the WordPress admin panel configures a malicious field identifier containing SQL injection payloads. When an unsuspecting visitor uses the search feature, the plugin executes the injected SQL query, allowing the attacker to extract sensitive data (e.g., user hashes) or modify content. A public exploit script is available, lowering the effort required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection vulnerability in the WPBot WordPress plugin before version 8.5.2 allows authenticated administrators to inject arbitrary SQL queries via unsanitized field identifiers. This injection executes when a site visitor triggers a search, potentially leading to low-level data exposure or modification. A public exploit is available, though no active exploitation has been confirmed by CISA KEV.
RemediationAI
Upgrade the WPBot plugin to version 8.5.2 or later, which is available from the vendor. As a workaround, restrict administrative access to trusted users only and consider using a Web Application Firewall (WAF) with SQL injection rules. However, the most effective mitigation is the patch, as WAFs may not catch all crafted inputs. No other side effects beyond limiting admin privileges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the WPBot plugin for WordPress, a chatbot assistant tool. The plugin fails to properly validate administrator-configured field identifiers before incorporating them into SQL queries, a classic SQL injection flaw (CWE-89). The CPE string cpe:2.3:a:unknown:wpbot:*:*:*:*:*:*:*:* indicates the product is listed under an unknown vendor, but it is a well-known WordPress plugin. The attack vector is network-based (AV:N) but requires high privileges (PR:H) consistent with administrator roles in WordPress.
Know when Wpbot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
High privileges required for admin access, low impact on data.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and includin
The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauth
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing
The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the das
The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9
The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as
Missing capability checks in the WPBot WordPress plugin before 8.7.6 allow any authenticated subscriber-level user to ov
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to upda
The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9
Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.7.8 versions. Rated high severity
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high p
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high p
Exploit-DB