CVE-2026-16774
Received Received - Intake

Missing Authorization in WordPress Chatbot Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-16774
EUVD
EUVD-2026-49759

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordfence chatbot_plugin to 8.5.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Chatbot plugin for WordPress has a vulnerability in versions up to 8.5.9 where the wpcs_send_email() function lacks proper authorization checks. It is registered for both authenticated and unauthenticated users without nonce verification, capability checks, or rate limiting. Attackers can exploit this to send arbitrary emails from the site's domain to any recipient, enabling spam or phishing campaigns.

Detection Guidance

Check WordPress sites running the Chatbot plugin version 8.5.9 or lower. Look for unauthorized email activity in logs or email server logs. Monitor for unusual outbound SMTP traffic from the WordPress server.

Impact Analysis

This vulnerability allows unauthenticated attackers to send emails from your WordPress site. This could lead to your domain being blacklisted due to spam or phishing activities, damaging your site's reputation and email deliverability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized email transmissions. Unauthenticated attackers can send arbitrary emails from the site's domain, which may lead to data breaches or unauthorized disclosures of sensitive information, violating GDPR's data protection principles and HIPAA's confidentiality requirements.

Mitigation Strategies

Update the Chatbot plugin to the latest version. Disable the wpcs_send_email() AJAX handler if not needed. Implement server-side email restrictions to block unauthorized outbound emails. Review email server logs for signs of abuse.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16774. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart