CVE-2026-14185: missing auth check lets subscribers

CISO Take

WPBot, a WordPress AI chatbot plugin, ships a retrieval-augmented-generation settings handler that skips both the capability check and the nonce check, so any authenticated user with subscriber-level access (the default self-registration role on many sites) can silently rewrite the plugin's configuration. There is no public exploit code, no Nuclei template, and it is not in CISA KEV, and the CVSS 4.3 score reflects that impact is confined to integrity of configuration data with no confidentiality or availability loss. The real risk is indirect: whoever controls WPBot's RAG settings controls where the chatbot pulls its retrieval content from and how it responds, which opens the door to RAG poisoning or redirected data retrieval without ever needing admin credentials. Sites that allow open user registration or comment-based account creation are the most exposed, since that is the easiest way to obtain the subscriber role needed to trigger this. Patch to WPBot 8.2.0 or later, and in the interim disable public subscriber self-registration or review the plugin's RAG source/endpoint settings for unauthorized changes.

Sources: NVD ATLAS wpscan.com

What is the risk?

Medium severity per CVSS (4.3), driven down by low privileges required and network-only integrity impact (no confidentiality or availability loss). However, the barrier to exploitation is low: subscriber accounts are frequently self-registered or easily obtained on public WordPress sites, attack complexity is low, and no user interaction is needed. No EPSS data, no public exploit, and no CISA KEV listing exist yet, so near-term mass exploitation is unlikely, but the missing capability/nonce check is a well-understood, easily automated bug class (CWE-862) that opportunistic scanners could pick up quickly once a PoC surfaces.

How does the attack unfold?

Initial Access

Attacker obtains a subscriber-level WordPress account via open self-registration.

AML.T0012

Exploitation

Attacker sends a request to WPBot's RAG settings handler, which lacks capability and nonce checks, allowing unauthorized changes.

AML.T0049

Configuration Tampering

Attacker modifies the RAG configuration to point to an attacker-controlled retrieval source or altered parameters.

AML.T0081

Impact

Site visitors interacting with the chatbot receive responses shaped by poisoned retrieval content, enabling misinformation or data redirection.

AML.T0070

Initial Access

Attacker obtains a subscriber-level WordPress account via open self-registration.

AML.T0012

Exploitation

Attacker sends a request to WPBot's RAG settings handler, which lacks capability and nonce checks, allowing unauthorized changes.

AML.T0049

Configuration Tampering

Attacker modifies the RAG configuration to point to an attacker-controlled retrieval source or altered parameters.

AML.T0081

Impact

Site visitors interacting with the chatbot receive responses shaped by poisoned retrieval content, enabling misinformation or data redirection.

AML.T0070

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A None

What should I do?

1 step

Upgrade WPBot to version 8.2.0 or later immediately. Until patched, disable open subscriber self-registration or restrict it via an approval workflow, and audit existing subscriber accounts for suspicious activity. After patching, review WPBot's RAG/retrieval settings for unexpected changes (source URLs, prompts, API endpoints) made prior to the fix. Monitor WordPress admin-ajax/REST logs for POST requests to WPBot settings endpoints originating from non-admin sessions, and consider adding a WAF rule that blocks configuration-changing requests lacking a valid nonce as defense in depth.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Plugin RAG AML.T0070 - RAG Poisoning AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - Access control of AI system configuration

NIST AI RMF

GOVERN-1.5 - Access control and authorization for AI system components

OWASP LLM Top 10

LLM06 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-14185?

WPBot, a WordPress AI chatbot plugin, ships a retrieval-augmented-generation settings handler that skips both the capability check and the nonce check, so any authenticated user with subscriber-level access (the default self-registration role on many sites) can silently rewrite the plugin's configuration. There is no public exploit code, no Nuclei template, and it is not in CISA KEV, and the CVSS 4.3 score reflects that impact is confined to integrity of configuration data with no confidentiality or availability loss. The real risk is indirect: whoever controls WPBot's RAG settings controls where the chatbot pulls its retrieval content from and how it responds, which opens the door to RAG poisoning or redirected data retrieval without ever needing admin credentials. Sites that allow open user registration or comment-based account creation are the most exposed, since that is the easiest way to obtain the subscriber role needed to trigger this. Patch to WPBot 8.2.0 or later, and in the interim disable public subscriber self-registration or review the plugin's RAG source/endpoint settings for unauthorized changes.

Is CVE-2026-14185 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-14185, increasing the risk of exploitation.

How to fix CVE-2026-14185?

Upgrade WPBot to version 8.2.0 or later immediately. Until patched, disable open subscriber self-registration or restrict it via an approval workflow, and audit existing subscriber accounts for suspicious activity. After patching, review WPBot's RAG/retrieval settings for unexpected changes (source URLs, prompts, API endpoints) made prior to the fix. Monitor WordPress admin-ajax/REST logs for POST requests to WPBot settings endpoints originating from non-admin sessions, and consider adding a WAF rule that blocks configuration-changing requests lacking a valid nonce as defense in depth.

What systems are affected by CVE-2026-14185?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, plugin.

What is the CVSS score for CVE-2026-14185?

CVE-2026-14185 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesplugin

MITRE ATLAS Techniques

AML.T0070 RAG Poisoning

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN-1.5

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration.

Exploitation Scenario

An adversary registers (or already holds) a subscriber-level account on a WordPress site running vulnerable WPBot — trivial on sites with open registration or comment systems. The attacker crafts a direct request to WPBot's RAG settings handler, which performs no capability or nonce validation, and changes the retrieval configuration to point at an attacker-controlled data source or endpoint. Site visitors interacting with the chatbot thereafter receive responses shaped by the attacker's injected retrieval content, enabling downstream RAG poisoning, misinformation, or redirection of sensitive queries to an external collection point — all without the attacker ever needing admin credentials.

Weaknesses (CWE)

CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.