Vulnerability · Published Sep 12, 2026 · Assigned by WPScan
CVE-2026-87918WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions
Medium 5.3
In plain English
A medium-severity improper access control in WPBot from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 74.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/d6b3745b-bda1-4734-b39c-75376477ba0a/ exploit, vdb-entry, technical-description