CVE-2026-15106
Received Received - Intake

Authorization Bypass in WPBot WordPress Plugin

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: Wordfence

Description
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbot_user and wpbot_conversation tables, including chat history and conversation logs, by supplying a crafted userid value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-15106
EUVD
EUVD-2026-44892

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpbot ai_chatbot_for_live_support to 8.5.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WPBot plugin for WordPress has an authorization bypass vulnerability in versions up to 8.5.6. It fails to verify user permissions properly, allowing unauthenticated attackers to delete chat session records by providing a crafted userid value.

Detection Guidance

Check WordPress plugin logs for unauthorized deletion attempts in wpbot_user or wpbot_conversation tables. Review database access logs for suspicious queries targeting these tables.

Impact Analysis

Unauthenticated attackers could delete chat history and conversation logs from the database, potentially erasing important customer interactions or support records without detection.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by allowing unauthorized deletion of sensitive user data, including chat histories that may contain personal or protected information.

Mitigation Strategies
  • Update the WPBot plugin to the latest version immediately.
  • Restrict database access permissions for the WordPress user to prevent unauthorized deletions.
  • Monitor chat session records for any unexpected deletions or modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15106. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart