CVE-2026-87916 Overview
CVE-2026-87916 affects the WPBot WordPress plugin in versions prior to 8.6.0. The plugin exposes an AJAX action that lists stored chat sessions without performing capability or nonce checks. Unauthenticated attackers can query the endpoint with a wide date range to retrieve the name, email address, and phone number of every chat visitor. The flaw is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor and is exploitable remotely over the network without user interaction.
Critical Impact
Unauthenticated attackers can harvest personally identifiable information (PII) of all chat visitors, including names, email addresses, and phone numbers.
Affected Products
- WPBot WordPress plugin versions prior to 8.6.0
- WordPress sites running vulnerable WPBot installations
- Stored chat session records containing visitor PII
Discovery Timeline
- 2026-09-12 - CVE-2026-87916 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-87916
Vulnerability Analysis
The WPBot plugin registers an AJAX action that returns stored chat sessions from the WordPress database. The handler omits both current_user_can() capability verification and check_ajax_referer() nonce validation. Any unauthenticated visitor can invoke the endpoint via wp-admin/admin-ajax.php and receive session records in the response.
Attackers submitting a wide date range parameter retrieve every stored chat session in a single request. Returned fields include the visitor name, email address, and phone number captured during chatbot interactions. The disclosed data enables phishing, credential stuffing preparation, and targeted social engineering.
Root Cause
The root cause is missing authentication and authorization on a server-side AJAX endpoint that processes sensitive data. The plugin exposes the handler through both the wp_ajax_ and wp_ajax_nopriv_ hooks without validating the requester's identity or verifying a nonce token to confirm request origin.
Attack Vector
Exploitation requires only an HTTP POST request to the WordPress AJAX endpoint. The attacker supplies the vulnerable action name along with start and end date parameters that cover the entire history of stored sessions. The server returns the full dataset in the response body. No authentication, session, or user interaction is required. Refer to the WPScan Vulnerability Advisory for additional technical detail.
Detection Methods for CVE-2026-87916
Indicators of Compromise
- Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing the WPBot chat-session listing action
- Request payloads containing unusually broad date range parameters spanning months or years
- Large AJAX response bodies from admin-ajax.php containing structured visitor contact fields
- Repeated queries from a single IP address enumerating chat session data
Detection Strategies
- Inspect web server access logs for POST requests to admin-ajax.php with WPBot-related action parameters originating from unauthenticated sessions
- Alert on responses from admin-ajax.php that exceed a size baseline established for normal plugin activity
- Deploy WordPress security plugins or a web application firewall (WAF) rule that flags AJAX calls to WPBot endpoints lacking a valid nonce
Monitoring Recommendations
- Audit outbound data volumes from WordPress hosts to detect bulk exfiltration of chat records
- Monitor plugin inventory to confirm WPBot is updated to 8.6.0 or later on all managed sites
- Track failed and successful requests to chat-related AJAX actions in a centralized log platform for anomaly review
How to Mitigate CVE-2026-87916
Immediate Actions Required
- Update the WPBot WordPress plugin to version 8.6.0 or later on every affected site
- Rotate any credentials or contact records shared through the chat interface if compromise is suspected
- Review web server logs for prior enumeration of the vulnerable AJAX endpoint and notify affected visitors if data was exfiltrated
Patch Information
The vendor addressed the flaw in WPBot version 8.6.0 by adding capability and nonce checks to the AJAX handler that lists stored chat sessions. Administrators should upgrade through the WordPress plugin management console or by deploying the updated plugin package. Full advisory details are available in the WPScan Vulnerability Advisory.
Workarounds
- Deactivate and remove the WPBot plugin until the site can be upgraded to a patched release
- Restrict access to /wp-admin/admin-ajax.php for the affected action names using a WAF rule or .htaccess deny directives
- Purge stored chat session records that are no longer needed to reduce the volume of data exposed by any successful exploitation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
