CVE-2026-16774
MediumCVSS 5.3Summary
The Chatbot plugin for WordPress up to version 8.5.9 is vulnerable to Missing Authorization in the wpcs_send_email() AJAX handler. The function is registered for both authenticated and unauthenticated users without nonce verification, capability check, or rate limiting, and forwards attacker-controlled recipient, subject, and body directly to wp_mail(). This allows unauthenticated attackers to send arbitrary emails from the site's domain.
Risk Assessment
An attacker can exploit this to send spam, phishing, or other malicious emails, potentially leading to the site's IP/domain being blacklisted and reputational damage.
Recommendation
Immediately update the Chatbot plugin to the latest available version that contains the fix for this vulnerability.
Other vulnerabilities in Chatbot
See all- CVE-2026-57363High
The ChatBot plugin for WordPress up to version 8.3.7 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject a malicious script that executes on every page load.
- CVE-2026-57362High
The ChatBot plugin version 8.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2026-40788High
ChatBot versions up to 7.9.7 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Original NVD description (English source)
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.