CVE-2026-87918: CWE-284 Improper Access Control in WPBot
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
AI Analysis
Technical Summary
The WPBot WordPress plugin prior to version 8.5.7 does not enforce authorization or nonce verification on multiple AJAX endpoints that relay user prompts to AI service providers configured within the plugin. As a result, unauthenticated attackers can invoke these AJAX actions to trigger API calls to third-party AI providers using the site's own API keys, leading to unauthorized usage and potential financial impact due to consumption of paid API resources.
Potential Impact
Unauthenticated attackers can exploit this vulnerability to make API calls to third-party AI providers using the victim site's API keys. This can lead to unauthorized consumption of paid API resources, potentially resulting in unexpected costs for the site owner. There is no indication of direct data compromise or system takeover from the provided information.
Mitigation Recommendations
A fix is available in WPBot version 8.5.7 and later. Site administrators should upgrade to version 8.5.7 or newer to ensure proper authorization and nonce checks are enforced on AJAX actions. Until upgrading, restricting access to AJAX endpoints or disabling the plugin may reduce risk, but upgrading is the recommended remediation.
CVE-2026-87918: CWE-284 Improper Access Control in WPBot
Description
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
CVSS v3.1
Score 5.3medium
Affected software
WPBot
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WPBot WordPress plugin prior to version 8.5.7 does not enforce authorization or nonce verification on multiple AJAX endpoints that relay user prompts to AI service providers configured within the plugin. As a result, unauthenticated attackers can invoke these AJAX actions to trigger API calls to third-party AI providers using the site's own API keys, leading to unauthorized usage and potential financial impact due to consumption of paid API resources.
Potential Impact
Unauthenticated attackers can exploit this vulnerability to make API calls to third-party AI providers using the victim site's API keys. This can lead to unauthorized consumption of paid API resources, potentially resulting in unexpected costs for the site owner. There is no indication of direct data compromise or system takeover from the provided information.
Mitigation Recommendations
A fix is available in WPBot version 8.5.7 and later. Site administrators should upgrade to version 8.5.7 or newer to ensure proper authorization and nonce checks are enforced on AJAX actions. Until upgrading, restricting access to AJAX endpoints or disabling the plugin may reduce risk, but upgrading is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-09T15:57:18.363Z
- State
- PUBLISHED
Threat ID: 6aa4ee6555bf5e2cf5f22002
Added to database: 09/12/2026, 06:17:09 UTC
Last enriched: 09/12/2026, 06:32:16 UTC
Last updated: 09/13/2026, 02:07:22 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.