CVE-2026-16773: WPBot unauth PII exfil

CISO Take

WPBot, a WordPress AI chatbot plugin used for live support and lead generation, contains a sensitive information exposure flaw in its wpbot_send_email_transcript_free function that lets any unauthenticated visitor trigger an export of stored chat transcripts and PII (names, emails, phone numbers) from the wpbot_user and wpbot_conversation tables to an attacker-controlled email address. There's no authentication or user interaction required (CVSS 3.1, AV:N/PR:N/UI:N), which means any internet-facing WordPress site running an affected version can be scraped for lead and customer data with a single crafted request, and this qualifies as a mass-exploitable bulk data harvesting bug rather than a targeted attack. There is no EPSS score, no CISA KEV listing, and no known public exploit or Nuclei template yet, so treat urgency as moderate rather than critical — but the trivial exploitation bar and the plugin's popularity on lead-gen sites raise real GDPR/privacy exposure. Confirm the WPBot/chatbot plugin version in use, check the vendor advisory and changeset for a patched release beyond 8.5.9, and if none is available disable or restrict the transcript-email feature and monitor outbound admin-ajax/REST requests to wpbot_send_email_transcript_free for anomalous external recipient addresses.

Sources: NVD Wordfence ATLAS

What is the risk?

Medium severity (CVSS 5.3) but low exploitation complexity: no privileges, no user interaction, network-reachable. Impact is confidentiality-only (C:L/I:N/A:N) but includes regulated PII (names, emails, phone numbers), so real-world risk is amplified by GDPR/privacy exposure rather than technical severity alone. No EPSS data, no CISA KEV listing, and no public exploit code or scanner template currently known, so active mass-exploitation has not been observed — but the near-zero exploitation bar means this could be weaponized quickly and cheaply once discovered by data-harvesting bots that already scan WordPress plugin endpoints at scale.

How does the attack unfold?

Reconnaissance

Attacker identifies WordPress sites running the vulnerable WPBot plugin version via plugin fingerprinting.

AML.T0006

Exploitation

Attacker sends an unauthenticated request to wpbot_send_email_transcript_free specifying an attacker-controlled destination email.

AML.T0049

Data collection

The plugin queries the wpbot_user and wpbot_conversation tables, compiling full chat transcripts and PII.

AML.T0036

Exfiltration

Compiled transcripts and PII are emailed directly to the attacker, completing the data theft without any authentication.

AML.T0025

Reconnaissance

Attacker identifies WordPress sites running the vulnerable WPBot plugin version via plugin fingerprinting.

AML.T0006

Exploitation

Attacker sends an unauthenticated request to wpbot_send_email_transcript_free specifying an attacker-controlled destination email.

AML.T0049

Data collection

The plugin queries the wpbot_user and wpbot_conversation tables, compiling full chat transcripts and PII.

AML.T0036

Exfiltration

Compiled transcripts and PII are emailed directly to the attacker, completing the data theft without any authentication.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
WPBot	pip	—	No patch

Do you use WPBot? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I None

A None

What should I do?

1 step

1) Identify all WordPress sites running the WPBot plugin and check the installed version against the vendor's fixed release once published (patched version not specified in current advisory data — monitor the WordPress.org changeset and Wordfence advisory for an update). 2) Until patched, disable the transcript-to-email feature or restrict wpbot_send_email_transcript_free from unauthenticated access via a WAF rule or nonce/capability check at the web server layer. 3) Rotate/audit any email addresses configured to receive transcripts and review server logs for unexpected calls to this endpoint from unfamiliar IPs. 4) Monitor outbound mail logs for transcript emails sent to addresses outside the organization's domain. 5) Treat any historical chat PII as potentially exposed and assess breach notification obligations under GDPR if the plugin has been active and internet-facing.

How is it classified?

Data Leakage Privacy Violation Plugin Agent AML.T0025 - Exfiltration via Cyber Means AML.T0047 - AI-Enabled Product or Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 10 - Data and Data Governance

ISO 42001

A.7.2 - Data for AI Systems

NIST AI RMF

MEASURE 2.6 - Privacy Risk Assessment

OWASP LLM Top 10

LLM06:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-16773?

WPBot, a WordPress AI chatbot plugin used for live support and lead generation, contains a sensitive information exposure flaw in its wpbot_send_email_transcript_free function that lets any unauthenticated visitor trigger an export of stored chat transcripts and PII (names, emails, phone numbers) from the wpbot_user and wpbot_conversation tables to an attacker-controlled email address. There's no authentication or user interaction required (CVSS 3.1, AV:N/PR:N/UI:N), which means any internet-facing WordPress site running an affected version can be scraped for lead and customer data with a single crafted request, and this qualifies as a mass-exploitable bulk data harvesting bug rather than a targeted attack. There is no EPSS score, no CISA KEV listing, and no known public exploit or Nuclei template yet, so treat urgency as moderate rather than critical — but the trivial exploitation bar and the plugin's popularity on lead-gen sites raise real GDPR/privacy exposure. Confirm the WPBot/chatbot plugin version in use, check the vendor advisory and changeset for a patched release beyond 8.5.9, and if none is available disable or restrict the transcript-email feature and monitor outbound admin-ajax/REST requests to wpbot_send_email_transcript_free for anomalous external recipient addresses.

Is CVE-2026-16773 actively exploited?

No confirmed active exploitation of CVE-2026-16773 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-16773?

1) Identify all WordPress sites running the WPBot plugin and check the installed version against the vendor's fixed release once published (patched version not specified in current advisory data — monitor the WordPress.org changeset and Wordfence advisory for an update). 2) Until patched, disable the transcript-to-email feature or restrict wpbot_send_email_transcript_free from unauthenticated access via a WAF rule or nonce/capability check at the web server layer. 3) Rotate/audit any email addresses configured to receive transcripts and review server logs for unexpected calls to this endpoint from unfamiliar IPs. 4) Monitor outbound mail logs for transcript emails sent to addresses outside the organization's domain. 5) Treat any historical chat PII as potentially exposed and assess breach notification obligations under GDPR if the plugin has been active and internet-facing.

What systems are affected by CVE-2026-16773?

This vulnerability affects the following AI/ML architecture patterns: conversational AI / chatbot plugins, lead generation forms, customer support chat logging.

What is the CVSS score for CVE-2026-16773?

CVE-2026-16773 has a CVSS v3.1 base score of 5.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

conversational AI / chatbot pluginslead generation formscustomer support chat logging

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0047 AI-Enabled Product or Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 10

ISO 42001: A.7.2

NIST AI RMF: MEASURE 2.6

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbot_send_email_transcript_free. This makes it possible for unauthenticated attackers to exfiltrate full chat transcripts and associated user PII — including names, email addresses, and phone numbers — stored in the wpbot_user and wpbot_conversation tables to an attacker-controlled email address.

Exploitation Scenario

An attacker discovers a WordPress site running WPBot (via plugin fingerprinting or Wappalyzer-style scanning), then sends a crafted unauthenticated request to the wpbot_send_email_transcript_free handler, supplying an attacker-controlled email address as the transcript recipient. The plugin, lacking authorization checks, queries the wpbot_user and wpbot_conversation tables and emails the full chat history — including any names, emails, and phone numbers visitors shared with the chatbot — directly to the attacker. This can be automated and repeated across many WordPress installs running the vulnerable plugin version, turning it into a low-effort, high-yield PII harvesting technique against lead-gen and customer-support chatbot deployments.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.