CVE-2026-87916: WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
WPBot versions 8.4.9 through 8.5.9 are affected. The issue is in an AJAX action for listing stored chat sessions.
Does exploitation require an account or user interaction?
No. The affected AJAX action lacks both capability and nonce checks, so an unauthenticated attacker can request it without authorization or a victim interaction.
What information could be disclosed?
An attacker can retrieve the name, email address, and phone number of every stored chat visitor. Requesting a wide date range can expose records across that period.
What should be done if the plugin cannot be updated immediately?
The provided information does not identify a workaround. Restricting access to the affected AJAX action would need to prevent unauthenticated requests, but no specific mitigation is provided.