The AI ChatBot for WooCommerce – WoowBot plugin for WordPress up to version 5.0.0 contains an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to trigger repeated RAG document sync operations that consume paid AI API credits from the site administrator's stored key. The vulnerability arises because the plugin does not properly verify user authorization and exposes a required nonce to all authenticated frontend users, enabling trivial exploitation.