What is the CVSS score of CVE-2026-40788?

CVE-2026-40788 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of ChatBot Plugin are affected by CVE-2026-40788?

The QuantumCloud ChatBot plugin for WordPress (versions ≤7.9.7) contains a broken access control vulnerability (CVE-2026-40788, CVSS 7.1) that allows authenticated low-privileged users to execute…

How to fix or mitigate CVE-2026-40788?

Within 24 hours: Inventory all WordPress installations running QuantumCloud ChatBot plugin versions ≤7.9.7; document deployment scope, active users, and Subscriber-level account count. Within 7 days: Disable or remove the vulnerable plugin from affected sites, or restrict Subscriber-role permissions at the WordPress platform level to eliminate unnecessary capabilities; monitor Patchstack advisory for patch status updates. Within 30 days: No vendor-released patch identified at time of analysis-if patch becomes available, upgrade all installations to the patched version; conduct user access review and implement enhanced role-based access controls.

ChatBot Plugin CVE-2026-40788

EUVD-2026-36991 HIGH

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-cw8r-c33f-4p9j

Authentication Bypass Chatbot

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

7.1 HIGH

Network-reachable WordPress endpoint, low complexity, requires Subscriber auth (PR:L), no UI; missing authorization yields no confidentiality loss, low integrity tampering, and high availability impact on the plugin.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:06 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.

AnalysisAI

Broken access control in the QuantumCloud ChatBot plugin for WordPress (versions <= 7.9.7) allows authenticated low-privileged users (Subscriber role) to invoke restricted plugin functionality without proper authorization checks, leading to integrity tampering and availability disruption. Reported by Patchstack and tracked as EUVD-2026-36991, with no public exploit identified at time of analysis.

Technical ContextAI

The flaw resides in the QuantumCloud ChatBot WordPress plugin (cpe:2.3:a:quantumcloud:chatbot), a conversational chatbot extension typically installed on customer-facing WordPress sites. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints - usually exposed via WordPress AJAX actions (wp-admin/admin-ajax.php) or REST routes - fail to perform a capability check (current_user_can) before executing privileged operations. Because any authenticated WordPress user, including self-registered Subscribers on sites with open registration, can reach these endpoints, the missing authorization gate collapses the role separation the plugin should enforce.

RemediationAI

Patch available per vendor advisory - upgrade the ChatBot plugin to the version above 7.9.7 listed in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/chatbot/vulnerability/wordpress-chatbot-plugin-7-9-7-broken-access-control-vulnerability) by updating through the WordPress plugin dashboard or via WP-CLI (wp plugin update chatbot). Until the upgrade is applied, compensating controls include disabling open user registration in WordPress Settings > General (trade-off: blocks legitimate self-signup flows on membership/e-commerce sites), restricting access to wp-admin/admin-ajax.php and any chatbot REST routes via a WAF rule that requires editor-or-above roles (trade-off: may break legitimate Subscriber AJAX features in other plugins), or temporarily deactivating the ChatBot plugin if its functionality is non-essential (trade-off: loss of chatbot feature for site visitors).