CVE-2026-87918 — WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions

CVE-2026-87918

WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions PUBLISHED

Description (CNA)

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.

Affected (CNA)

Vendor / product	Versions
Unknown / WPBot	affected 0 before 8.5.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/d6b3745b-bda1-4734-b39c-75376477ba0a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.