CVE-2026-14189 describes a SQL injection vulnerability (CWE-89) in the WPBot WordPress plugin versions prior to 8.5.2. The issue arises because the plugin fails to validate field identifiers configured by administrators before incorporating them into SQL queries. This flaw enables users with administrator access to craft SQL injection payloads that execute when a site visitor performs a search action. The vulnerability is rated with a CVSS 3.1 base score of 3.8 (low severity), indicating limited impact on confidentiality and integrity, and no impact on availability. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with administrator privileges can exploit this vulnerability to perform SQL injection attacks via specially crafted field identifiers. This could lead to limited unauthorized disclosure or modification of data within the database when a visitor triggers a search. The impact is limited to confidentiality and integrity with no availability impact, and the overall severity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when configuring field identifiers and restrict administrator access to trusted users only. Monitor official WPBot channels for updates regarding patches or mitigations.