CVE-2026-16774: WordPress Chatbot Auth Bypass Vulnerability

CVE-2026-16774 Overview

CVE-2026-16774 is a Missing Authorization vulnerability [CWE-862] in the Chatbot plugin for WordPress affecting all versions up to and including 8.5.9. The wpcs_send_email() AJAX handler is registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email without nonce verification, capability checks, or rate limiting. Attacker-controlled recipient, subject, and body parameters are passed directly to wp_mail(). Unauthenticated attackers can send arbitrary emails from the affected site's domain, enabling spam and phishing campaigns that risk blacklisting the site's IP and domain reputation.

Critical Impact
Unauthenticated remote attackers can abuse the vulnerable AJAX endpoint to send arbitrary emails from the victim WordPress site, facilitating phishing and spam distribution that damages domain reputation.

Affected Products

Chatbot plugin for WordPress versions up to and including 8.5.9
WordPress installations exposing the admin-ajax.php endpoint with the plugin enabled
Sites with SMTP or mail transport configured through wp_mail()

Discovery Timeline

2026-07-28 - CVE-2026-16774 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-16774

Vulnerability Analysis

The Chatbot plugin exposes the wpcs_send_email() function through two WordPress AJAX action hooks. Registering the handler on wp_ajax_nopriv_wpcs_send_email makes the endpoint reachable by unauthenticated users. The handler does not verify a WordPress nonce, does not check user capabilities, and applies no rate limiting.

The handler forwards user-supplied POST parameters directly into wp_mail(). Attackers control the recipient address, the subject line, and the message body. The email originates from the site's configured sender identity, giving the message legitimacy from the domain's SPF, DKIM, and DMARC posture.

While the flaw does not permit direct code execution or data theft, the resulting abuse degrades sender reputation. Sustained exploitation leads to IP and domain blacklisting on major mail providers.

Root Cause

The root cause is a missing authorization control [CWE-862]. The plugin author registered a mail-sending routine on the unauthenticated AJAX hook without implementing any of the standard WordPress access controls: check_ajax_referer(), current_user_can(), or throttling. Any anonymous HTTP request to /wp-admin/admin-ajax.php with action=wpcs_send_email reaches the vulnerable code path.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker issues a POST request to admin-ajax.php specifying the wpcs_send_email action along with recipient, subject, and body fields. The server processes the request as if it originated from a legitimate chatbot session and dispatches the email through the site's mail transport. The plugin source at wpbot-chat-sessions.php lines 478, 483, and 494 shows the parameter handling. See the WordPress Plugin Source Code and the Wordfence Vulnerability Analysis for further technical details.

Detection Methods for CVE-2026-16774

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=wpcs_send_email from unauthenticated sources
Outbound email volume spikes originating from the WordPress host without corresponding administrative activity
Bounce notifications for messages the site administrators did not send
Appearance of the site's domain or sending IP on public spam blocklists such as Spamhaus or Barracuda

Detection Strategies

Inspect web server access logs for repeated wpcs_send_email AJAX calls, particularly from a small set of source IPs
Correlate mail transfer agent logs against WordPress access logs to identify emails triggered by the vulnerable endpoint
Deploy WordPress-aware web application firewall rules that flag unauthenticated invocations of privileged AJAX actions
Monitor SMTP relay counters for anomalous deliveries from PHP processes on the WordPress host

Monitoring Recommendations

Alert on sudden increases in wp_mail() invocations using PHP logging or an APM agent
Track sender reputation with third-party services and alert on blocklist listings
Review DMARC aggregate reports for messages the organization did not authorize

How to Mitigate CVE-2026-16774

Immediate Actions Required

Update the Chatbot plugin to a version newer than 8.5.9 that includes the fix referenced in the WordPress Changeset Update
Deactivate the plugin if a patched release cannot be applied immediately
Review outbound mail logs for evidence of abuse and notify recipients of any confirmed phishing messages
Request delisting from any blocklists the domain or IP appears on after remediation

Patch Information

The plugin author published a corrective changeset (3621386@chatbot) that adds authorization enforcement to the wpcs_send_email() handler. Site operators should apply the update through the WordPress plugin manager. Review the Wordfence Vulnerability Analysis for the fixed version details.

Workarounds

Block requests to admin-ajax.php with action=wpcs_send_email at the web application firewall until patching is complete
Restrict the WordPress host's outbound SMTP to authenticated relays and enforce per-source rate limits
Temporarily disable anonymous chatbot email features in the plugin configuration where the option is exposed

bash

# Example ModSecurity rule to block unauthenticated abuse of the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026016774,\
    msg:'Block CVE-2026-16774 wpcs_send_email abuse'"
  SecRule ARGS:action "@streq wpcs_send_email" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"