CVE-2026-87918
Received Received - Intake

WPBot Plugin Unauthenticated AI API Calls

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: WPScan

Description
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-87918
EUVD
EUVD-2026-76806

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpbot wpbot to 8.5.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WPBot WordPress plugin before version 8.5.7 has a vulnerability where it does not verify authorization or nonce checks for certain AJAX actions. This allows unauthenticated attackers to send prompts to connected AI providers using the site's API keys without permission.

Detection Guidance

Check if the WPBot plugin version is below 8.5.7. Inspect network traffic for unauthorized AJAX calls to the plugin's endpoints. Look for unusual API usage patterns from third-party AI providers.

Impact Analysis

Unauthenticated attackers can make third-party API calls using your site's configured API keys, which may lead to unexpected costs for API usage. It also exposes your site to potential abuse of AI services.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized third-party API calls that may expose or transmit sensitive data without proper authorization. Unauthenticated attackers could use the site's configured API keys to relay prompts to AI providers, potentially leading to unauthorized data processing or disclosure.

Mitigation Strategies

Update the WPBot plugin to version 8.5.7 or later immediately. Review API keys for third-party AI providers and revoke any potentially compromised keys. Monitor API usage for unauthorized activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87918. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart