CVE-2026-15610 is an authorization bypass vulnerability (CWE-862) in the WPBot plugin for WordPress by quantumcloud. The plugin fails to properly verify user authorization for certain actions, enabling authenticated users with subscriber-level privileges or above to manipulate stored RAG documents. This manipulation can modify the rag_documents table and cause unauthorized use of paid AI API credits from services such as OpenAI, Gemini, OpenRouter, or xAI. The vulnerability affects all versions up to and including 8.5.6. No official patch or remediation guidance has been provided as of the publication date.

The vulnerability allows authenticated users with low-level privileges (subscriber and above) to bypass authorization controls and modify stored RAG documents. This can lead to unauthorized modification of database content and consumption of the site owner's paid AI API credits, potentially resulting in financial loss. There is no indication of direct data confidentiality or availability impact beyond the unauthorized modification and resource consumption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user access where possible and monitor usage of AI API credits to detect unusual consumption patterns. Avoid granting unnecessary privileges to authenticated users. Follow updates from the vendor quantumcloud for any forthcoming patches or official mitigations.