CVE-2026-87918
WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 12, 2026
- Updated
- Sep 12, 2026
- Reserved
- Sep 9, 2026
Description
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
WPBotUnknown |
|
References
- https://wpscan.com/vulnerability/d6b3745b-bda1-4734-b39c-75376477ba0a/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.