CVE-2026-40788
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
ChatBot versions up to 7.9.7 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data, potentially leading to loss of confidentiality and integrity of information.
Recommendation
It is recommended to update ChatBot to the latest version to mitigate this access control vulnerability.
Other vulnerabilities in ChatBot
See all- CVE-2026-16774Medium
The Chatbot plugin for WordPress up to version 8.5.9 is vulnerable to Missing Authorization in the wpcs_send_email() AJAX handler. The function is registered for both authenticated and unauthenticated users without nonce verification, capability check, or rate limiting, and forwards attacker-controlled recipient, subject, and body directly to wp_mail(). This allows unauthenticated attackers to send arbitrary emails from the site's domain.
- CVE-2026-57363High
The ChatBot plugin for WordPress up to version 8.3.7 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject a malicious script that executes on every page load.
- CVE-2026-57362High
The ChatBot plugin version 8.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
Original NVD description (English source)
Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.