The WPBot Pro Wordpress Chatbot plugin for WordPress suffers from a missing capability check in the 'qc_wp_latest_update_check_pro' function, which leads to unauthorized modification of data. Authenticated attackers with Subscriber-level privileges or higher can exploit this flaw to create Simple Text Responses to chatbot queries without proper authorization. This issue affects all versions up to 13.5.5 and is tracked as CVE-2024-12879 with a CVSS 3.1 base score of 4.3 (medium severity). No patch or vendor advisory indicating a fix is currently available.

The vulnerability allows authenticated users with low privileges (Subscriber-level and above) to modify chatbot response data by creating Simple Text Responses without proper authorization. This could lead to unauthorized content being served by the chatbot, potentially misleading users or disrupting chatbot functionality. There is no impact on confidentiality or system availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for unusual chatbot response modifications. Avoid granting unnecessary privileges to low-level authenticated users.