CVE-2026-15610: WPBot auth bypass burns AI API

CISO Take

WPBot, a widely installed WordPress AI chatbot plugin, fails to verify that users are authorized before triggering re-embedding of stored RAG documents, so any authenticated subscriber-level account — the lowest privilege tier, often self-registrable — can repeatedly force the plugin to call the site owner's paid OpenAI, Gemini, OpenRouter, or xAI API and modify the rag_documents table. There's no CISA KEV listing, no public exploit or Nuclei template, and no EPSS score yet since this was just published, so this isn't an active-exploitation emergency — but the CVSS 4.3 low bar (AC:L, PR:L, UI:N) means a bot registering a subscriber account could hit this at scale with zero social engineering. The real CISO risk here isn't data breach, it's an unbounded-consumption financial attack: an attacker (or a competitor) can silently run up your LLM API bill. Patch to the fixed WPBot release as soon as it's available, and in the interim disable open self-registration on any WordPress site running this plugin, set hard spend caps/alerts on the OpenAI/Gemini/OpenRouter/xAI keys used by WPBot, and watch for anomalous embedding-endpoint call volume from low-privilege accounts.

Sources: NVD ATLAS wordfence.com

What is the risk?

Medium severity is appropriate: exploitability is high (network vector, low complexity, no user interaction, only subscriber-level privilege required — a tier many WordPress sites hand out via open registration), but impact is scoped to integrity (I:L) with no confidentiality or availability CVSS impact. There is no CISA KEV entry, no EPSS percentile yet, and no known public exploit or scanner template, so this is not currently under mass exploitation. The practical risk is financial (cost harvesting / unbounded LLM consumption) rather than data exposure, which caps the blast radius but can still produce real, unbudgeted third-party API charges if left unpatched on a site with open registration.

How does the attack unfold?

Initial Access

Attacker obtains or registers a subscriber-level WordPress account on a site running WPBot, often via open self-registration.

AML.T0012

Exploitation

Attacker invokes the plugin's RAG re-embedding action directly, bypassing the missing authorization check meant to restrict it to privileged users.

AML.T0049

Impact

Repeated invocation forces unauthorized calls to the site's paid OpenAI/Gemini/OpenRouter/xAI API and rewrites the rag_documents table, draining the owner's AI budget.

AML.T0034

Initial Access

Attacker obtains or registers a subscriber-level WordPress account on a site running WPBot, often via open self-registration.

AML.T0012

Exploitation

Attacker invokes the plugin's RAG re-embedding action directly, bypassing the missing authorization check meant to restrict it to privileged users.

AML.T0049

Impact

Repeated invocation forces unauthorized calls to the site's paid OpenAI/Gemini/OpenRouter/xAI API and rewrites the rag_documents table, draining the owner's AI budget.

AML.T0034

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
WPBot	pip	—	No patch

Do you use WPBot? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I Low

A None

What should I do?

1 step

Update WPBot to the first version beyond 8.5.6 as soon as the vendor patch is confirmed (check the plugin's WordPress.org changelog before assuming a fix is live). Until patched: restrict or disable open user self-registration so untrusted accounts can't reach subscriber-level access; add WAF/rate-limiting rules on the plugin's re-embedding AJAX/REST action; set hard spend alerts/caps on the OpenAI, Gemini, OpenRouter, and xAI API keys used by the site; and audit the rag_documents table plus recent API usage logs for abnormal re-embedding volume from low-privilege or newly created accounts.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Plugin RAG AML.T0012 - Valid Accounts AML.T0034 - Cost Harvesting AML.T0034.001 - Resource-Intensive Queries AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-15610?

WPBot, a widely installed WordPress AI chatbot plugin, fails to verify that users are authorized before triggering re-embedding of stored RAG documents, so any authenticated subscriber-level account — the lowest privilege tier, often self-registrable — can repeatedly force the plugin to call the site owner's paid OpenAI, Gemini, OpenRouter, or xAI API and modify the rag_documents table. There's no CISA KEV listing, no public exploit or Nuclei template, and no EPSS score yet since this was just published, so this isn't an active-exploitation emergency — but the CVSS 4.3 low bar (AC:L, PR:L, UI:N) means a bot registering a subscriber account could hit this at scale with zero social engineering. The real CISO risk here isn't data breach, it's an unbounded-consumption financial attack: an attacker (or a competitor) can silently run up your LLM API bill. Patch to the fixed WPBot release as soon as it's available, and in the interim disable open self-registration on any WordPress site running this plugin, set hard spend caps/alerts on the OpenAI/Gemini/OpenRouter/xAI keys used by WPBot, and watch for anomalous embedding-endpoint call volume from low-privilege accounts.

Is CVE-2026-15610 actively exploited?

No confirmed active exploitation of CVE-2026-15610 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-15610?

Update WPBot to the first version beyond 8.5.6 as soon as the vendor patch is confirmed (check the plugin's WordPress.org changelog before assuming a fix is live). Until patched: restrict or disable open user self-registration so untrusted accounts can't reach subscriber-level access; add WAF/rate-limiting rules on the plugin's re-embedding AJAX/REST action; set hard spend alerts/caps on the OpenAI, Gemini, OpenRouter, and xAI API keys used by the site; and audit the rag_documents table plus recent API usage logs for abnormal re-embedding volume from low-privilege or newly created accounts.

What systems are affected by CVE-2026-15610?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, plugin-based AI chatbots, third-party LLM API integrations.

What is the CVSS score for CVE-2026-15610?

CVE-2026-15610 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesplugin-based AI chatbotsthird-party LLM API integrations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0034 Cost Harvesting

AML.T0034.001 Resource-Intensive Queries

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger arbitrary re-embedding of stored RAG documents, modifying the rag_documents table and consuming the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).

Exploitation Scenario

An attacker registers a free subscriber-level account on a WordPress site running WPBot (or uses a throwaway account if registration is open), then directly calls the plugin's RAG re-embedding action — which never checks whether the caller is authorized to trigger it — and scripts repeated calls against every stored RAG document. Each call forces the site to make a paid embedding API request to whichever provider (OpenAI/Gemini/OpenRouter/xAI) the owner has configured, running up the bill with no legitimate business purpose, while also repeatedly rewriting the rag_documents table.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.