CVE-2026-87916
Received Received - Intake

Unauthenticated Chat Session Data Exposure in WPBot WordPress Plugin

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: WPScan

Description
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-87916
EUVD
EUVD-2026-76805

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpbot wpbot From 8.4.9 (inc) to 8.5.9 (inc)
wpbot wpbot to 8.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WPBot WordPress plugin before version 8.6.0 has a vulnerability where it does not check user permissions or use security tokens for an AJAX action that retrieves chat session data. This allows unauthenticated attackers to access stored chat visitor information, including names, email addresses, and phone numbers, by requesting a wide date range of sessions.

Detection Guidance

To detect this vulnerability, check if your WPBot plugin version is between 8.4.9 and 8.5.9. You can verify the installed version via WordPress admin panel or by inspecting plugin files. Additionally, monitor network traffic for unauthorized AJAX requests to chat session endpoints.

Impact Analysis

If you use the WPBot plugin versions 8.4.9 through 8.5.9, attackers could steal personally identifiable information (PII) of your website visitors, such as their names, email addresses, and phone numbers. This could lead to privacy breaches, identity theft, or misuse of the exposed data.

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations by exposing personal data without proper safeguards. Organizations could face fines or legal consequences for failing to protect visitor data, especially if the data includes sensitive information covered under HIPAA or similar standards.

Mitigation Strategies

Immediately update the WPBot plugin to version 8.6.0 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review server logs for suspicious activity related to chat session data access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87916. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart