Ai Chatbot For Woocommerce Woowbot
Monthly
Billable AI embedding calls can be triggered repeatedly by any authenticated subscriber on WordPress sites running WoowBot 5.0.0 or earlier, draining the administrator's stored OpenAI, Gemini, OpenRouter, or xAI credits. The only prerequisites are a logged-in account and a configured paid provider key; the wp_chatbot nonce is emitted to every authenticated frontend visitor via wp_localize_script and is not a meaningful barrier. Rated CVSS 4.3 (PR:L, integrity-only impact), no public exploit identified at time of analysis, and the vendor fix is in the 5.0.1 release.
Billable AI embedding calls can be triggered repeatedly by any authenticated subscriber on WordPress sites running WoowBot 5.0.0 or earlier, draining the administrator's stored OpenAI, Gemini, OpenRouter, or xAI credits. The only prerequisites are a logged-in account and a configured paid provider key; the wp_chatbot nonce is emitted to every authenticated frontend visitor via wp_localize_script and is not a meaningful barrier. Rated CVSS 4.3 (PR:L, integrity-only impact), no public exploit identified at time of analysis, and the vendor fix is in the 5.0.1 release.