WPBot ChatBot EUVD-2026-44892

No authentication is required and no special site configuration is needed - the vulnerability exists in the default installation of WPBot on any WordPress site running version 8.5.6 or earlier. The only prerequisite is that the WPBot plugin is installed, activated, and that the WordPress site is reachable over the network. Exploitation is limited by the narrow impact: the attacker can only delete records from the wpbot_user and wpbot_conversation tables and cannot read data (C:N per CVSS) or disrupt service availability. The scope is also unchanged (S:U), meaning the vulnerability cannot be leveraged to escape the plugin's database context or compromise the broader WordPress installation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) characterizes this as a low-complexity, unauthenticated network attack with limited integrity impact and no scope change. Real-world risk is constrained by the narrow impact: an attacker can only delete chat records, not read them (C:N) and cannot disrupt service availability (A:N). This makes the vulnerability primarily a data-integrity and privacy concern for site operators - loss of support logs, lead-generation conversation history, and user session data - rather than a pivot point for broader system compromise. No EPSS data was provided, and neither KEV listing nor public exploit code has been identified, suggesting exploitation is not currently widespread or automated. The attack requires no authentication and no special configuration, meaning any publicly accessible WordPress site running an affected version is potentially targetable; however, the low-impact ceiling limits attacker motivation for mass exploitation. This is a genuine but moderate-priority issue: patch during the next maintenance window rather than emergency response, unless chat logs contain sensitive lead or customer data that would make their deletion a compliance or business-continuity concern.

An attacker enumerates a WordPress site running WPBot ≤8.5.6, then issues an unauthenticated HTTP request to the plugin's chat-session deletion endpoint with a fabricated or iterated userid value. Because no authorization check is performed, the server deletes the corresponding records from the wpbot_user and wpbot_conversation tables without any authentication. An attacker could systematically iterate userid values to bulk-erase all stored conversation history. No public exploit code has been identified, but the attack requires no credentials and minimal technical sophistication.