CVE-2026-15106: WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbotuser and wpbotconversation tables, including chat history and conversation logs, by supplying a crafted userid value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WPBot – AI ChatBot for Live Support, Lead Generation, AI Servicesto a version that resolves this vulnerability.Fixed in 8.5.6 - Compensating control
Restrict access to the WordPress back end endpoints and/or the plugin’s affected request path so that unauthenticated users cannot reach the action that deletes chat session records (mitigate the authorization bypass described for the 'userid' parameter).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15106?
The severity of CVE-2026-15106 is medium with a CVSS score of 5.3.
What does CVE-2026-15106 entail?
CVE-2026-15106 involves a missing authorization that allows unauthenticated users to delete arbitrary chat sessions via the 'userid' parameter.
How do I mitigate CVE-2026-15106?
To mitigate CVE-2026-15106, update the WPBot plugin to the latest version where the authorization bypass has been fixed.
Which versions of WPBot are affected by CVE-2026-15106?
CVE-2026-15106 affects all versions of WPBot up to and including 8.5.6.
Is CVE-2026-15106 exploitable remotely?
Yes, CVE-2026-15106 can be exploited remotely since it involves an authorization bypass without requiring user authentication.