Ai Chatbot For Woocommerce
Monthly
Unauthenticated API abuse in the AI ChatBot for WooCommerce WordPress plugin (all versions before 4.8.4) permits any remote visitor to trigger a backend AJAX action with no authorization check or nonce validation, causing the plugin to forward requests to the site owner's stored third-party AI API credentials - generating charges billed directly to the owner's account. A publicly available exploit exists per WPScan, though EPSS sits at 0.15% (5th percentile), indicating limited current automated exploitation; this CVE is not listed in the CISA KEV catalog. When the plugin's optional knowledge-base indexing feature is enabled, the same unprotected endpoint additionally exposes indexed site content to unauthenticated retrieval, introducing a confidentiality dimension alongside the financial abuse risk.
Unauthenticated API abuse in the AI ChatBot for WooCommerce WordPress plugin (all versions before 4.8.4) permits any remote visitor to trigger a backend AJAX action with no authorization check or nonce validation, causing the plugin to forward requests to the site owner's stored third-party AI API credentials - generating charges billed directly to the owner's account. A publicly available exploit exists per WPScan, though EPSS sits at 0.15% (5th percentile), indicating limited current automated exploitation; this CVE is not listed in the CISA KEV catalog. When the plugin's optional knowledge-base indexing feature is enabled, the same unprotected endpoint additionally exposes indexed site content to unauthenticated retrieval, introducing a confidentiality dimension alongside the financial abuse risk.