CVE-2026-15106: WPBot broken auth lets attackers

CISO Take

WPBot, an AI-powered chatbot plugin used for live support and lead generation on WordPress sites, contains a missing-authorization flaw that lets an unauthenticated attacker submit a crafted userid value and delete arbitrary chat session records — including full conversation history — from the wpbot_user and wpbot_conversation database tables. There is no confidentiality or code-execution impact (CVSS 3.1 vector C:N/I:L/A:N, score 5.3), and neither an EPSS score nor a public exploit or Nuclei template exists yet, so mass opportunistic exploitation isn't confirmed — but the attack requires no privileges, no user interaction, and only network access, making it trivial to script once a site is fingerprinted as running WPBot ≤8.5.6. For a CISO the real exposure isn't data breach, it's data destruction: loss of customer chat transcripts and lead-generation conversation history that may function as an audit trail or support record, with a service-continuity hit if teams rely on that data. Patch beyond 8.5.6 immediately wherever this plugin is deployed; where patching lags, block unauthenticated access to the plugin's chat-session endpoints and ensure the underlying tables are covered by regular backups so deleted records are recoverable.

Sources: NVD Wordfence plugins.trac.wordpress.org ATLAS

What is the risk?

Medium severity (CVSS 5.3) driven by trivial exploitability (network access, low complexity, no privileges or user interaction required) offset by narrow impact scope (integrity-only, low severity, no confidentiality or availability effect per the CVSS vector). No EPSS score, no CISA KEV listing, and no public PoC or Nuclei template currently observed, so confirmed real-world exploitation likelihood is low at this time — but that could change quickly given the exploit is a simple parameter-manipulation request against an unauthenticated endpoint. Risk is elevated specifically for organizations that treat WPBot chat logs as a compliance/audit record or as CRM lead data, since a successful attack destroys that data with no recovery path other than backups.

How does the attack unfold?

Recon / Fingerprinting

Attacker identifies WordPress sites running the WPBot ≤8.5.6 plugin via plugin enumeration or asset fingerprinting.

AML.T0006

Exploitation

Attacker sends an unauthenticated request with a crafted userid parameter to WPBot's chat-session endpoint, bypassing the missing authorization check.

AML.T0049

Impact

Arbitrary records are deleted from wpbot_user and wpbot_conversation, destroying chat history and lead data with no confidentiality or code-execution impact.

Recon / Fingerprinting

Attacker identifies WordPress sites running the WPBot ≤8.5.6 plugin via plugin enumeration or asset fingerprinting.

AML.T0006

Exploitation

Attacker sends an unauthenticated request with a crafted userid parameter to WPBot's chat-session endpoint, bypassing the missing authorization check.

AML.T0049

Impact

Arbitrary records are deleted from wpbot_user and wpbot_conversation, destroying chat history and lead data with no confidentiality or code-execution impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
WPBot	pip	—	No patch

Do you use WPBot? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A None

What should I do?

1 step

1) Update WPBot to a version beyond 8.5.6 that adds a proper authorization check on the chat-session deletion path (see the vendor's SVN changeset diff between 8.4.9/8.5.0 and the fixed release). 2) If immediate patching isn't feasible, block or rate-limit unauthenticated requests to the plugin's chat-session/admin-ajax deletion action via WAF. 3) Take regular backups of the wpbot_user and wpbot_conversation tables so any deleted records can be restored. 4) Monitor web server/WAF logs for repeated unauthenticated requests hitting the plugin's chat-session endpoints with varying or sequential userid values, which would indicate enumeration or active exploitation. 5) If WPBot logs are relied on for any compliance or support-evidence purpose, stand up an independent export/backup process until the patch is confirmed applied.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Plugin Agent AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 12 - Record-keeping

ISO 42001

A.7 - Data for AI systems

Frequently Asked Questions

What is CVE-2026-15106?

WPBot, an AI-powered chatbot plugin used for live support and lead generation on WordPress sites, contains a missing-authorization flaw that lets an unauthenticated attacker submit a crafted userid value and delete arbitrary chat session records — including full conversation history — from the wpbot_user and wpbot_conversation database tables. There is no confidentiality or code-execution impact (CVSS 3.1 vector C:N/I:L/A:N, score 5.3), and neither an EPSS score nor a public exploit or Nuclei template exists yet, so mass opportunistic exploitation isn't confirmed — but the attack requires no privileges, no user interaction, and only network access, making it trivial to script once a site is fingerprinted as running WPBot ≤8.5.6. For a CISO the real exposure isn't data breach, it's data destruction: loss of customer chat transcripts and lead-generation conversation history that may function as an audit trail or support record, with a service-continuity hit if teams rely on that data. Patch beyond 8.5.6 immediately wherever this plugin is deployed; where patching lags, block unauthenticated access to the plugin's chat-session endpoints and ensure the underlying tables are covered by regular backups so deleted records are recoverable.

Is CVE-2026-15106 actively exploited?

No confirmed active exploitation of CVE-2026-15106 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-15106?

1) Update WPBot to a version beyond 8.5.6 that adds a proper authorization check on the chat-session deletion path (see the vendor's SVN changeset diff between 8.4.9/8.5.0 and the fixed release). 2) If immediate patching isn't feasible, block or rate-limit unauthenticated requests to the plugin's chat-session/admin-ajax deletion action via WAF. 3) Take regular backups of the wpbot_user and wpbot_conversation tables so any deleted records can be restored. 4) Monitor web server/WAF logs for repeated unauthenticated requests hitting the plugin's chat-session endpoints with varying or sequential userid values, which would indicate enumeration or active exploitation. 5) If WPBot logs are relied on for any compliance or support-evidence purpose, stand up an independent export/backup process until the patch is confirmed applied.

What systems are affected by CVE-2026-15106?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, chat session storage/logging.

What is the CVSS score for CVE-2026-15106?

CVE-2026-15106 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

agent frameworkschat session storage/logging

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 12

ISO 42001: A.7

What are the technical details?

Original Advisory

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbot_user and wpbot_conversation tables, including chat history and conversation logs, by supplying a crafted userid value.

Exploitation Scenario

An attacker fingerprints WordPress sites to identify which ones run the WPBot chatbot widget (via plugin enumeration or asset signatures), requiring no prior access. Without authenticating, the attacker sends a crafted HTTP request to the plugin's chat-session management endpoint, supplying an arbitrary or sequential userid value; because the plugin never verifies the requester is authorized to act on that userid, the backend deletes the matching rows from wpbot_user and wpbot_conversation. By iterating over a range of userid values, the attacker can mass-delete chat history and lead-generation records site-wide, silently destroying customer support transcripts and AI-generated lead qualification data until the site owner notices logs or conversations are missing.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.