CVE-2026-87916

Deferred Deferred - Pending Action

Unauthenticated Chat Session Data Exposure in WPBot WordPress Plugin

Publication date: 2026-09-12

Last updated on: 2026-09-14

Assigner: WPScan

Description

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-12

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-87916

EUVD

EUVD-2026-76805

Affected Vendors & Products

Vendor	Product	Version / Range
wpbot	wpbot	From 8.4.9 (inc) to 8.5.9 (inc)
wpbot	wpbot	to 8.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The WPBot WordPress plugin before version 8.6.0 has a vulnerability where it does not check user permissions or use security tokens for an AJAX action that retrieves chat session data. This allows unauthenticated attackers to access stored chat visitor information, including names, email addresses, and phone numbers, by requesting a wide date range of sessions.

Detection Guidance

To detect this vulnerability, check if your WPBot plugin version is between 8.4.9 and 8.5.9. You can verify the installed version via WordPress admin panel or by inspecting plugin files. Additionally, monitor network traffic for unauthorized AJAX requests to chat session endpoints.

Impact Analysis

If you use the WPBot plugin versions 8.4.9 through 8.5.9, attackers could steal personally identifiable information (PII) of your website visitors, such as their names, email addresses, and phone numbers. This could lead to privacy breaches, identity theft, or misuse of the exposed data.

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations by exposing personal data without proper safeguards. Organizations could face fines or legal consequences for failing to protect visitor data, especially if the data includes sensitive information covered under HIPAA or similar standards.

Mitigation Strategies

Immediately update the WPBot plugin to version 8.6.0 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review server logs for suspicious activity related to chat session data access.

Hi! I’m here to help you understand CVE-2026-87916. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70