EUVD-2026-76806
GHSA-54cr-fg97-fjjx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated AJAX with no prerequisites; A:L added because uncontrolled API relay can exhaust quota and degrade chatbot availability.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
AnalysisAI
Unauthenticated API abuse in the WPBot WordPress plugin before 8.5.7 allows any remote attacker to invoke the plugin's AI provider relay endpoints without credentials or a nonce, causing the site's configured third-party API keys (e.g., OpenAI) to issue requests and accrue charges on the site owner's account. The root cause is a complete absence of WordPress capability checks and nonce verification on multiple wp_ajax_nopriv-eligible AJAX actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must have the WPBot plugin installed, active, and configured with at least one AI provider API key in a version prior to 8.5.7. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the zero-prerequisite, fully network-accessible nature of this flaw, though the A:N metric arguably understates the resource-exhaustion dimension: sustained automated abuse can drain API quota, trigger billing overages, or rate-limit the chatbot's availability for legitimate users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WPBot to version 8.5.7 or later, which introduces proper authorization checks and nonce validation on the affected AJAX actions per the WPScan advisory (https://wpscan.com/vulnerability/d6b3745b-bda1-4734-b39c-75376477ba0a/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today