SecvalisbySYSDEVOPS.EU
CVE Catalog
EnglishPolski

CVE-2026-87959

MediumCVSS 5.4
Published: Updated: Translated: NVD NIST

Exploitation Probability (EPSS)

Low risk
0.16%

6th percentile - higher than 6% of all known CVEs

Summary

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for outgoing AI requests.

Risk Assessment

A low-privileged user can overwrite the API key and AI provider settings, potentially leading to unauthorized costs, key leakage, or interception of AI service communication.

Recommendation

Update the WPBot plugin to version 8.7.6 or later.

Other vulnerabilities in WPBot WordPress plugin

Original NVD description (English source)

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS