What is the CVSS score of EUVD-2026-44892?

EUVD-2026-44892 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

WPBot ChatBot EUVD-2026-44892

| CVE-2026-15106 MEDIUM

Missing Authorization (CWE-862)

2026-07-16 Wordfence

GHSA-w9hj-67x9-qq26

WordPress Authentication Bypass Wordpress Plugin Wpbot Ai Chatbot For Live Support Lead Generation Ai Services Quantumcloud

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable endpoint, no auth or interaction required, scope unchanged; impact is record deletion only, so I:L and C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 09:07 vuln.today

CVE Published

Jul 16, 2026 - 07:51 cve.org

MEDIUM 5.3

DescriptionCVE.org

The WPBot - AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbot_user and wpbot_conversation tables, including chat history and conversation logs, by supplying a crafted userid value.

AnalysisAI

Unauthorized deletion of chat session records in the WPBot WordPress plugin affects all versions through 8.5.6, allowing unauthenticated remote attackers to wipe arbitrary conversation history and user records by supplying a crafted userid parameter to unprotected endpoints. The root cause is a missing authorization check (CWE-862) in the chat sessions module, confirmed by Wordfence with source-level references to the vulnerable code in wpbot-chat-sessions.php. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned score of 5.3 Medium reflects the limited scope: data deletion with no confidentiality or availability impact on the service itself.

Technical ContextAI

The affected component is QuantumCloud's WPBot plugin for WordPress (CPE: cpe:2.3:a:quantumcloud:wpbot_-_ai_chatbot_for_live_support,_lead_generation,_ai_services:*:*:*:*:*:*:*:*), a chatbot solution offering live support, AI services, and lead generation. The vulnerability class is CWE-862 (Missing Authorization): the plugin exposes chat session management actions - specifically record deletion targeting the wpbot_user and wpbot_conversation database tables - without verifying that the requesting party is authorized to perform those operations. Source references in the Wordfence disclosure point to lines 372, 391, and 393 of wpbot-chat-sessions.php in plugin tags 8.4.9 and 8.5.0, suggesting the flaw has persisted across multiple minor releases. A changeset reference (revision 3608558) indicates a corrective code change was committed to the plugin repository.

RemediationAI

Update the WPBot plugin to a version released after 8.5.6; a corrective changeset (revision 3608558 in the WordPress plugin repository) has been committed, but an exact patched release version is not independently confirmed from the available data - verify the latest available version in the WordPress plugin directory before upgrading. As an interim workaround, if the chat sessions feature is not actively required, consider temporarily deactivating the plugin or using a WAF rule to block unauthenticated POST/GET requests to the plugin's session deletion endpoints (paths referencing wpbot-chat-sessions). Note that deactivating the plugin will also disable all chatbot functionality. Site operators using chat logs for lead generation or compliance purposes should assess whether retained conversation data requires additional backup or access controls independent of this fix. The full Wordfence advisory is at https://www.wordfence.com/threat-intel/vulnerabilities/id/dc36ee53-81a9-416e-8e74-31d9c8802d6c.