5.3

CVE-2026-16774

WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.
Mögliche Gegenmaßnahme
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services: Update to version 8.6.0, or a newer patched version
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerquantumcloud
≫
Produkt WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
Default Statusunaffected
Version <= 8.5.9
Version 0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
Version *-8.5.9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.145
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://plugins.trac.wordpress.org/changeset?reponame=&old=3621386%40chatbot&new=3621386%40chatbot
https://www.wordfence.com/threat-intel/vulnerabilities/id/3cc6aa06-ab2a-4d5c-bbbe-4c19722ccc53?source=cve
https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.9/includes/chat-sessions/wpbot-chat-sessions.php#L494
https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.9/includes/chat-sessions/wpbot-chat-sessions.php#L483
https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.9/includes/chat-sessions/wpbot-chat-sessions.php#L478
https://www.wordfence.com/threat-intel/vulnerabilities/id/3cc6aa06-ab2a-4d5c-bbbe-4c19722ccc53
Third Party Advisory