WPBot EUVD-2026-44893

Exploitation requires a valid WordPress account with at minimum subscriber-level access - the lowest registered-user role, obtainable via standard WordPress registration if open registration is enabled. The site must have WPBot plugin version 8.5.6 or earlier installed and active, and at least one third-party AI API (OpenAI, Gemini, OpenRouter, or xAI) must be configured with a valid API key for RAG document embedding. Unauthenticated visitors cannot exploit this flaw (PR:L confirmed by CVSS vector). The magnitude of financial harm is bounded by the configured API key's quota and billing limits. No administrator interaction, special network position, non-default WordPress configuration beyond AI API setup, or specific server-side state is required beyond holding a subscriber account.

The CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately captures the narrow CIA-triad impact: no data is exposed, and integrity impact is limited to modification of the rag_documents table. However, the CVSS vector does not capture financial harm, which is the dominant real-world risk here - repeated unauthorized re-embedding requests can rapidly exhaust paid AI API credits, resulting in service disruption of the chatbot feature and unexpected billing for the site owner. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The absence of a KEV listing and the lack of confirmed public exploit code both reduce urgency relative to the full CVSS attack surface. The attack requires at minimum a registered WordPress account (PR:L), which limits opportunistic mass exploitation compared to unauthenticated flaws. Exploitation is most realistic in multi-tenant or membership-model WordPress sites where subscriber accounts are freely obtainable.

An attacker registers or uses an existing subscriber-level WordPress account on a site running WPBot ≤ 8.5.6 with an AI API key configured. The attacker sends repeated authenticated HTTP requests to the plugin's RAG re-embedding action, each of which the server processes without checking user capabilities, triggering embedding API calls to the site owner's OpenAI or Gemini account. Within minutes, the attacker can exhaust the site's API quota or accumulate significant billing charges, effectively denying AI chatbot functionality to legitimate users and imposing financial costs on the site operator.