CVE-2026-15610: WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger arbitrary re-embedding of stored RAG documents, modifying the ragdocuments table and consuming the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services pluginto a version that resolves this vulnerability.Fixed in 8.5.6 - Compensating control
Restrict authenticated access to the WordPress endpoints/requests that trigger ajax_rag_manual_sync() so that only users authorized to perform RAG document re-sync can call it (apply via WordPress role/capability checks or network/WAF/ACL restrictions on the relevant AJAX/action route).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15610?
The severity of CVE-2026-15610 is medium, with a score of 4.3.
What does CVE-2026-15610 affect?
CVE-2026-15610 affects the WPBot plugin for WordPress versions up to and including 8.5.6.
How can I fix CVE-2026-15610?
To fix CVE-2026-15610, update the WPBot plugin to the latest version that addresses the authorization bypass.
What type of vulnerability is CVE-2026-15610?
CVE-2026-15610 is an authorization bypass vulnerability allowing authenticated users to perform certain actions without proper permissions.
Who is impacted by CVE-2026-15610?
Authenticated users with Subscriber role or higher are impacted by CVE-2026-15610 due to lack of proper authorization checks.