WordPress Plugin Vulnerabilities

WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update

Description

The plugin does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the plugin's outgoing AI requests.

Proof of Concept

Affects Plugins

Plugin icon
chatbot
Fixed in 8.7.6

References

CVE
CVE-2026-87959

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Sergey Mkrtchyan (b1acksparrow)
Submitter
Sergey Mkrtchyan (b1acksparrow)
Verified
Yes
WPVDB ID
3d42171d-6335-4bd3-bbed-fc446da3f945

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other

Published
Title
Published
2024-12-11
Title
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce < 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
Published
2024-02-19
Title
WPify Woo Czech < 4.0.9 - Missing Authorization
Published
2024-03-01
Title
Avada < 7.11.6 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries
Published
2024-02-12
Title
Sunshine Photo Cart: Free Client Galleries for Photographers < 3.1 - Unauthenticated Sensitive Information Exposure via Invoice
Published
2021-11-03
Title
Event Manager for WooCommerce < 3.5.3 - Unauthenticated Arbitrary Options Reset