CVE-2026-16773 is a sensitive information exposure vulnerability (CWE-200) in the WPBot – AI ChatBot for Live Support, Lead Generation, AI Services WordPress plugin. The flaw exists in all versions up to and including 8.5.9 and allows unauthenticated attackers to exploit the wpbot_send_email_transcript_free function to send full chat transcripts and associated user PII from the wpbot_user and wpbot_conversation database tables to an attacker-controlled email address. This vulnerability does not require authentication or user interaction and has a CVSS 3.1 base score of 5.3, indicating medium severity. No official patch or remediation guidance has been provided by the vendor as of the published date.

An unauthenticated attacker can exfiltrate sensitive user information including full chat transcripts and personally identifiable information such as names, email addresses, and phone numbers. This exposure compromises user privacy and may lead to further targeted attacks or privacy violations. The vulnerability does not affect system integrity or availability but results in confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable functionality if possible or disable the wpbot_send_email_transcript_free feature to prevent unauthorized email transcript sending. Monitor for updates from the vendor quantumcloud regarding patches or official mitigations.