What the vulnerability does
01Description
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.
Explanation of Vulnerability in Simple Terms
02Summary
WPBot versions up to 8.5.9 lack proper authorization checks, allowing unauthenticated attackers to modify data through network requests. The vulnerability requires no user interaction and can be exploited remotely. Site administrators should update to a version newer than 8.5.9 to prevent unauthorized modifications.
What an attacker can do
03Attacker Capabilities
Modify data on the site without authentication or permission.
Potential impact on your site
04Site Impact
Attackers can alter WPBot settings, messages, or configurations without logging in.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 28, 2026
CVE published
July 28, 2026
Record updated
