CVE-2026-111372: WPBot missing authz lets

CISO Take

The WoowBot AI ChatBot for WooCommerce plugin (up to 5.0.0) fails to check authorization on its RAG document sync endpoint, so any logged-in subscriber can repeatedly trigger paid embedding calls billed to the site owner's stored OpenAI, Gemini, OpenRouter or xAI key. The required nonce is handed to every authenticated visitor, so exploitation is trivial for anyone who can register on a WooCommerce store. The CVSS is only 4.3 and there is no KEV listing, public exploit, Nuclei template or EPSS score yet, so this is not a mass-exploitation emergency. However, the impact is direct financial loss and possible API quota exhaustion that would take the chatbot offline. Upgrade to 5.0.1 or later, set hard spending caps and alerts on the AI provider account, and review provider usage logs for unexplained embedding spikes.

Sources:NVDATLASWordfencewordpress.org plugin repository

What is the risk?

Medium overall. Exploitability is high (network, low complexity, subscriber-level privileges, no user interaction, nonce exposed to all authenticated users), but the impact is limited to integrity (unauthorized metered API usage) with no confidentiality loss. Exposure is greatest on WooCommerce sites with open customer registration, where an attacker can self-provision a subscriber account. No active exploitation, KEV listing, public exploit or scanner template is known, and EPSS data is unavailable. Package risk score is 0/100 with no other CVEs tracked.

How does the attack unfold?

Initial Access

Attacker registers or uses a subscriber-level account on the WooCommerce site.

AML.T0012

Nonce Harvesting

Attacker reads the wp_chatbot nonce emitted via wp_localize_script to every authenticated frontend visitor.

Exploitation

Attacker repeatedly calls the unprotected RAG document sync endpoint, triggering paid embedding API calls with the admin's stored key.

AML.T0034.000

Impact

AI provider credits are drained, causing financial loss and possible chatbot outage from quota exhaustion.

AML.T0048.000

Initial Access

Attacker registers or uses a subscriber-level account on the WooCommerce site.

AML.T0012

Nonce Harvesting

Attacker reads the wp_chatbot nonce emitted via wp_localize_script to every authenticated frontend visitor.

Exploitation

Attacker repeatedly calls the unprotected RAG document sync endpoint, triggering paid embedding API calls with the admin's stored key.

AML.T0034.000

Impact

AI provider credits are drained, causing financial loss and possible chatbot outage from quota exhaustion.

AML.T0048.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
WPBot	pip	—	No patch

Do you use WPBot? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

ILow

ANone

What should I do?

1 step

1) Update WoowBot to 5.0.1 or later, which fixes the missing capability check in class-qcld-bot-rag.php. 2) If you cannot patch immediately, deactivate the plugin or disable the RAG feature, and restrict open user registration or the default subscriber role. 3) Set hard monthly budget limits and usage alerts on OpenAI, Gemini, OpenRouter and xAI accounts, and use a dedicated, scoped API key for the plugin. 4) Review provider usage dashboards for embedding request spikes, and review WordPress access logs for repeated admin-ajax.php calls to the RAG sync action from low-privilege accounts. 5) Audit for unexpected new subscriber registrations and rotate the API key if abuse is suspected.

How is it classified?

Auth BypassDoSPluginRAGAPIAML.T0012- Valid Accounts AML.T0034- Cost Harvesting AML.T0034.000- Excessive Queries AML.T0048.000- Financial Harm

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.9.2-Processes for responsible use of AI systems

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-111372?

The WoowBot AI ChatBot for WooCommerce plugin (up to 5.0.0) fails to check authorization on its RAG document sync endpoint, so any logged-in subscriber can repeatedly trigger paid embedding calls billed to the site owner's stored OpenAI, Gemini, OpenRouter or xAI key. The required nonce is handed to every authenticated visitor, so exploitation is trivial for anyone who can register on a WooCommerce store. The CVSS is only 4.3 and there is no KEV listing, public exploit, Nuclei template or EPSS score yet, so this is not a mass-exploitation emergency. However, the impact is direct financial loss and possible API quota exhaustion that would take the chatbot offline. Upgrade to 5.0.1 or later, set hard spending caps and alerts on the AI provider account, and review provider usage logs for unexplained embedding spikes.

Is CVE-2026-111372 actively exploited?

No confirmed active exploitation of CVE-2026-111372 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111372?

1) Update WoowBot to 5.0.1 or later, which fixes the missing capability check in class-qcld-bot-rag.php. 2) If you cannot patch immediately, deactivate the plugin or disable the RAG feature, and restrict open user registration or the default subscriber role. 3) Set hard monthly budget limits and usage alerts on OpenAI, Gemini, OpenRouter and xAI accounts, and use a dedicated, scoped API key for the plugin. 4) Review provider usage dashboards for embedding request spikes, and review WordPress access logs for repeated admin-ajax.php calls to the RAG sync action from low-privilege accounts. 5) Audit for unexpected new subscriber registrations and rotate the API key if abuse is suspected.

What systems are affected by CVE-2026-111372?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, LLM API integrations, WordPress AI chatbot plugins, E-commerce chatbots.

What is the CVSS score for CVE-2026-111372?

CVE-2026-111372 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesLLM API integrationsWordPress AI chatbot pluginsE-commerce chatbots

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0034Cost Harvesting

AML.T0034.000Excessive Queries

AML.T0048.000Financial Harm

Compliance Controls Affected

ISO 42001: A.9.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeatedly trigger RAG document sync operations that issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key, draining their AI API credits and causing financial loss. The wp_chatbot nonce required to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, making it trivially obtainable by any subscriber-level account.

Exploitation Scenario

An attacker registers a free customer or subscriber account on a WooCommerce store running WoowBot. After logging in, they read the wp_chatbot nonce from the localized JavaScript on any frontend page. They then script repeated authenticated AJAX requests to the RAG document sync action, each of which triggers embedding calls to the configured AI provider using the administrator's stored API key. Within hours the site's AI credits are exhausted, producing unexpected bills or provider-side throttling, and the chatbot stops working for real customers.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.