ChatBot Plugin CVE-2026-40788

Requires the attacker to hold valid WordPress credentials at the Subscriber role or higher on a site running ChatBot plugin version 7.9.7 or earlier - practical only when the target site permits self-registration (WordPress Settings > General > Membership = 'Anyone can register') or when Subscriber-level credentials can otherwise be obtained. No user interaction or non-default plugin configuration is required, the vulnerable endpoints are reachable over the network via standard WordPress AJAX or REST paths, and exploitation is limited to integrity and availability effects against the ChatBot plugin's own functionality and data per the C:N/I:L/A:H vector.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H reflects a network-reachable, low-complexity issue requiring only Subscriber-level credentials with no user interaction, and yields a 7.1 (High) score driven primarily by high availability impact and low integrity impact, with no confidentiality loss. Real-world risk is meaningfully elevated on WordPress sites that allow open user registration (membership, e-commerce, community sites) where any visitor can self-provision a Subscriber account and reach the vulnerable endpoints; on locked-down sites with no public registration, exposure is materially lower. No KEV listing, no EPSS score, and no public PoC are present in the supplied data, so this should be treated as a credible but not yet weaponized risk - patch promptly but it is not an emergency rivaling actively exploited bugs. The CVSS C:N rating implies no data disclosure, which should be verified against the Patchstack advisory since broken access control flaws can sometimes expose conversation logs or settings beyond what the vector suggests.

An attacker registers a Subscriber account on a target WordPress site running ChatBot <= 7.9.7 (or uses any existing low-privilege credentials), then sends authenticated HTTP requests to the plugin's unprotected AJAX or REST endpoints to invoke administrative actions such as modifying chatbot configuration, deleting conversation data, or disrupting the chatbot service. Because the CVSS vector indicates high availability impact, the most realistic outcome is denial of the chatbot feature or corruption of its state, with low integrity impact suggesting partial settings tampering; no public PoC is identified at time of analysis.