CVE-2026-15241
Received Received - Intake

Unauthenticated API Key Abuse in AI ChatBot for WooCommerce

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: WPScan

Description
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional feature is enabled, to retrieve indexed knowledge-base content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-15241
EUVD
EUVD-2026-51934

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce ai_chatbot to 4.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the AI ChatBot for WooCommerce WordPress plugin before version 4.8.4. It lacks authorization or nonce checks on an AJAX action, allowing unauthenticated users to misuse the site owner's stored third-party API key. This can lead to unauthorized requests billed to the owner's account and potential access to indexed knowledge-base content if an optional feature is enabled.

Detection Guidance

Check if the AI ChatBot for WooCommerce plugin version is below 4.8.4. Inspect network traffic for unauthorized AJAX requests to the vulnerable endpoint. Look for suspicious API key usage in third-party service logs.

Impact Analysis

If you are a site owner using the affected plugin, an attacker could exploit this to send requests billed to your account without permission. Additionally, sensitive knowledge-base content could be retrieved if the optional feature is enabled, potentially exposing confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's security requirements. Unauthorized billing could also raise compliance issues related to financial data handling.

Mitigation Strategies

Update the AI ChatBot for WooCommerce plugin to version 4.8.4 or later. Disable the plugin if not essential. Review third-party API keys for unauthorized usage and revoke if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart