PT-2026-65450 · Quantumcloud · Wpbot – Ai Chatbot For Live Support

Wordfence Prism · CVE-2026-16774 · Published 2026-07-28 · Updated 2026-07-28

Mitre

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs send email() AJAX handler. This is due to the wpcs send email() function being registered on both wp ajax wpcs send email and wp ajax nopriv wpcs send email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-16774

Affected Products

Wpbot – Ai Chatbot For Live Support

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-16774 · Security Note
• https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.9/includes/chat-sessions/wpbot-chat-sessions.php#L483 · Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3621386%40chatbot&new=3621386%40chatbot · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3cc6aa06-ab2a-4d5c-bbbe-4c19722ccc53?source=cve · Note
• https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.9/includes/chat-sessions/wpbot-chat-sessions.php#L478 · Note
• https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.9/includes/chat-sessions/wpbot-chat-sessions.php#L494 · Note