What is the CVSS score of CVE-2026-3506?

CVE-2026-3506 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3506?

Organizations using for WordPress is vulnerable to authorization bypass in all should be aware of moderate risk from CVE-2026-3506, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-3506?

Within 30 days: Identify affected systems running for WordPress is vulnerable to authorization bypass in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-3506

EUVD-2026-13998 MEDIUM

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-28gh-r3vv-g85j

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13998

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 5.3

DescriptionCVE.org

The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the site's MobileMonkey API token and company ID options, which can be used to hijack chatbot configuration and redirect visitor conversations to an attacker-controlled MobileMonkey account.

AnalysisAI

The WP-Chatbot for Messenger WordPress plugin versions up to 4.9 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite critical chatbot configuration options, specifically the MobileMonkey API token and company ID. This enables attackers to hijack the site's chatbot functionality and redirect visitor conversations to attacker-controlled accounts without requiring any authentication or user interaction. The vulnerability has a CVSS score of 5.3 with a network attack vector and no privilege requirements, making it readily exploitable by any remote attacker.

Technical ContextAI

The vulnerability stems from insufficient authorization checks in the WP-Chatbot for Messenger plugin (CPE: cpe:2.3:a:larrykim:wp-chatbot_for_messenger:*:*:*:*:*:*:*:*), specifically within the MobileMonkey API handler and admin configuration classes. Code analysis from the plugin repository indicates that functions in MobileMonkeyApi.php (lines 37, 52, 409) and admin classes (class-htcc-admin.php line 29, admin.php line 29, class-ht-cc.php line 178) fail to implement proper authorization verification before processing requests to update sensitive options. This falls under CWE-862 (Authorization Using an Incorrect Resource), where the plugin allows unauthenticated users to modify WordPress options that should be restricted to authorized administrators. The root cause is the absence of nonce validation and capability checks (wp_verify_nonce and current_user_can functions) on AJAX or option update endpoints, allowing any HTTP request to alter chatbot configuration.

RemediationAI

Immediately upgrade the WP-Chatbot for Messenger plugin to a version newer than 4.9, which should include authorization checks and nonce validation. Access the WordPress admin dashboard, navigate to Plugins, locate WP-Chatbot for Messenger, and click Update if available; if no patch is available, deactivate and remove the plugin until a patched version is released. As an interim measure while awaiting patches, restrict access to the WordPress admin area using a Web Application Firewall (WAF) rule that blocks requests to the plugin's configuration endpoints (typically /wp-admin/admin-ajax.php with actions related to chatbot configuration) from untrusted sources. Additionally, monitor the Wordfence advisory page (https://www.wordfence.com/threat-intel/vulnerabilities/id/32cce973-bc3b-45f1-ad4d-ff395d3a6c8e?source=cve) and the official WordPress plugin repository for security updates. Consider reviewing chatbot logs and MobileMonkey account activity for unauthorized access or configuration changes that may indicate prior exploitation.