CVE-2025-62952
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The ChatBot (QuantumCloud) plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 7.7.3.
Risk Assessment
The risk is the possibility of unauthorized access to administrative functions of the plugin, which could lead to unauthorized changes or data leakage.
Recommendation
It is recommended to update the ChatBot plugin to the latest version that includes the fix for the missing authorization.
Other vulnerabilities in ChatBot
See all- CVE-2026-16774Medium
The Chatbot plugin for WordPress up to version 8.5.9 is vulnerable to Missing Authorization in the wpcs_send_email() AJAX handler. The function is registered for both authenticated and unauthenticated users without nonce verification, capability check, or rate limiting, and forwards attacker-controlled recipient, subject, and body directly to wp_mail(). This allows unauthenticated attackers to send arbitrary emails from the site's domain.
- CVE-2026-57363High
The ChatBot plugin for WordPress up to version 8.3.7 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject a malicious script that executes on every page load.
- CVE-2026-57362High
The ChatBot plugin version 8.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2026-40788High
ChatBot versions up to 7.9.7 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Original NVD description (English source)
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.7.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS