Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wpbot:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wpbot (07d45d93-5a99-567e-9f6c-8775a2002f43) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-87959 |
vulnerable | 2026-10-13 12:28:48.328218 |
WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.
Published: 2026-09-16T06:00:17.359Z
Updated: 2026-09-17T12:32:13.415Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87916 |
vulnerable | 2026-09-16 04:33:01.517270 |
WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
Published: 2026-09-12T06:00:13.394Z
Updated: 2026-09-12T15:28:34.690Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87918 |
vulnerable | 2026-09-16 04:33:01.165908 |
WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
Published: 2026-09-12T06:00:13.576Z
Updated: 2026-09-12T15:28:19.145Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14185 |
vulnerable | 2026-07-29 00:26:16.858970 |
WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration.
Published: 2026-07-21T06:00:02.126Z
Updated: 2026-07-21T13:32:05.486Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.