CVE-2026-14185 describes a missing authorization (CWE-862) vulnerability in the WPBot WordPress plugin prior to version 8.2.0. The vulnerability arises because one of the plugin's settings handlers related to retrieval-augmented-generation does not perform necessary capability or nonce verification. As a result, users with low-level authenticated access (subscriber role) can modify the plugin's configuration, potentially leading to unauthorized changes within the plugin's operational parameters.

Authenticated users with subscriber-level privileges can modify WPBot plugin configuration settings without proper authorization checks. This could lead to unauthorized configuration changes that may affect the plugin's behavior or security posture. There is no indication of remote unauthenticated exploitation or direct code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is released, restrict subscriber-level user capabilities where possible and monitor for unusual configuration changes. Avoid granting unnecessary authenticated access to untrusted users.