Vulnerability · Published Aug 2, 2026 · Assigned by WPScan
CVE-2026-15241ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response
High 7.5
In plain English
A high-severity improper access control in AI ChatBot for WooCommerce from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 64.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional feature is enabled, to retrieve indexed knowledge-base content.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | AI ChatBot for WooCommerce | 0 – before 4.8.4 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://wpscan.com/vulnerability/81ab9ecd-5d7b-4d10-b255-65af869c46e2/ exploit, vdb-entry, technical-description