CVE-2026-16774: WPBot unauthenticated email abuse

CISO Take

WPBot, an AI chatbot plugin used on WordPress sites for live support, lead generation, and AI-powered services, registers an AJAX handler (wpcs_send_email) for both logged-in and anonymous users but never validates a nonce, checks a capability, or applies rate limiting before forwarding attacker-controlled recipient, subject, and body straight into wp_mail(). That means anyone on the internet can trigger arbitrary outbound email from the site's own domain with a single unauthenticated HTTP request — no AI/ML skill required, and there's no EPSS score, CISA KEV listing, public exploit, or Nuclei template yet, but the exploit bar is trivial and the flaw affects all versions up to 8.5.9. The impact isn't data theft (CVSS confidentiality/availability are both None); it's reputational and operational: an attacker can turn the site into a spam and phishing relay, which can get the domain and mail server IP blacklisted, breaking deliverability for every legitimate customer, marketing, and transactional email the business sends. No patched version is listed in the current advisory, so until Chatbot/WPBot ships a fix, block or rate-limit unauthenticated POSTs to admin-ajax.php with action=wpcs_send_email at the WAF/reverse-proxy layer, or disable the plugin's email-notification feature entirely. Monitor outbound mail volume, bounce rate, and spam-complaint rate from the site's sending domain as an early indicator this is already being abused.

Sources: NVD Wordfence

What is the risk?

CVSS 5.3 (medium) reflects low direct confidentiality/availability impact, but the real-world risk is understated by the score: an unauthenticated, zero-interaction, trivially-scriptable vulnerability with no rate limiting on a mail-sending function is a classic spam/phishing relay primitive. Exploitability is high (AV:N/AC:L/PR:N/UI:N) even though severity is capped at Low integrity impact by the CVSS model, which doesn't fully capture domain/IP reputation damage. No EPSS, KEV, or public PoC currently exist, so opportunistic mass-scanning campaigns (common against WordPress plugin CVEs once published) are the most likely near-term exploitation path rather than targeted attacks.

How does the attack unfold?

Recon

Attacker fingerprints WordPress sites running the WPBot chatbot plugin (≤8.5.9) and identifies the admin-ajax.php endpoint.

AML.T0049

Exploitation

Attacker sends an unauthenticated POST to admin-ajax.php with action=wpcs_send_email, supplying arbitrary recipient, subject, and body — no nonce or capability check blocks it.

AML.T0049

Abuse at scale

Attacker scripts repeated calls across many vulnerable sites to run bulk spam/phishing campaigns using each site's legitimate mail infrastructure.

Impact

Victim domains and mail server IPs get flagged or blacklisted by spam filters, degrading deliverability for the site owner's legitimate email.

AML.T0048.001

Recon

Attacker fingerprints WordPress sites running the WPBot chatbot plugin (≤8.5.9) and identifies the admin-ajax.php endpoint.

AML.T0049

Exploitation

Attacker sends an unauthenticated POST to admin-ajax.php with action=wpcs_send_email, supplying arbitrary recipient, subject, and body — no nonce or capability check blocks it.

AML.T0049

Abuse at scale

Attacker scripts repeated calls across many vulnerable sites to run bulk spam/phishing campaigns using each site's legitimate mail infrastructure.

Impact

Victim domains and mail server IPs get flagged or blacklisted by spam filters, degrading deliverability for the site owner's legitimate email.

AML.T0048.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
WPBot	pip	—	No patch

Do you use WPBot? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A None

What should I do?

1 step

1) Patch: upgrade WPBot/Chatbot plugin as soon as a fixed release is published (no patched version is currently listed in the advisory — track the vendor changeset). 2) Interim workaround: block or rate-limit unauthenticated requests to /wp-admin/admin-ajax.php with action=wpcs_send_email at the WAF/CDN/reverse-proxy layer; if the email-notification feature isn't business-critical, disable it in plugin settings. 3) Detection: monitor outbound SMTP/API mail volume, bounce rate, and spam-complaint rate for the domain; alert on abnormal spikes in admin-ajax.php requests with action=wpcs_send_email in access logs. 4) Hardening: ensure WordPress core enforces nonce verification (check_ajax_referer) and capability checks (current_user_can) on all AJAX handlers registered for wp_ajax_nopriv_* hooks as a standing plugin-review practice.

How is it classified?

Auth Bypass Social Engineering Plugin AML.T0048.001 - Reputational Harm AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE-4.1 - AI system risks and benefits are monitored and documented

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-16774?

WPBot, an AI chatbot plugin used on WordPress sites for live support, lead generation, and AI-powered services, registers an AJAX handler (wpcs_send_email) for both logged-in and anonymous users but never validates a nonce, checks a capability, or applies rate limiting before forwarding attacker-controlled recipient, subject, and body straight into wp_mail(). That means anyone on the internet can trigger arbitrary outbound email from the site's own domain with a single unauthenticated HTTP request — no AI/ML skill required, and there's no EPSS score, CISA KEV listing, public exploit, or Nuclei template yet, but the exploit bar is trivial and the flaw affects all versions up to 8.5.9. The impact isn't data theft (CVSS confidentiality/availability are both None); it's reputational and operational: an attacker can turn the site into a spam and phishing relay, which can get the domain and mail server IP blacklisted, breaking deliverability for every legitimate customer, marketing, and transactional email the business sends. No patched version is listed in the current advisory, so until Chatbot/WPBot ships a fix, block or rate-limit unauthenticated POSTs to admin-ajax.php with action=wpcs_send_email at the WAF/reverse-proxy layer, or disable the plugin's email-notification feature entirely. Monitor outbound mail volume, bounce rate, and spam-complaint rate from the site's sending domain as an early indicator this is already being abused.

Is CVE-2026-16774 actively exploited?

No confirmed active exploitation of CVE-2026-16774 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-16774?

1) Patch: upgrade WPBot/Chatbot plugin as soon as a fixed release is published (no patched version is currently listed in the advisory — track the vendor changeset). 2) Interim workaround: block or rate-limit unauthenticated requests to /wp-admin/admin-ajax.php with action=wpcs_send_email at the WAF/CDN/reverse-proxy layer; if the email-notification feature isn't business-critical, disable it in plugin settings. 3) Detection: monitor outbound SMTP/API mail volume, bounce rate, and spam-complaint rate for the domain; alert on abnormal spikes in admin-ajax.php requests with action=wpcs_send_email in access logs. 4) Hardening: ensure WordPress core enforces nonce verification (`check_ajax_referer`) and capability checks (`current_user_can`) on all AJAX handlers registered for `wp_ajax_nopriv_*` hooks as a standing plugin-review practice.

What systems are affected by CVE-2026-16774?

This vulnerability affects the following AI/ML architecture patterns: AI chatbot plugins (WordPress), public-facing web applications with AI features.

What is the CVSS score for CVE-2026-16774?

CVE-2026-16774 has a CVSS v3.1 base score of 5.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

AI chatbot plugins (WordPress)public-facing web applications with AI features

MITRE ATLAS Techniques

AML.T0048.001 Reputational Harm

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.

Exploitation Scenario

An attacker scans for WordPress sites running the WPBot chatbot plugin (identifiable via plugin fingerprinting or the presence of the chat widget), then sends a raw HTTP POST to /wp-admin/admin-ajax.php with action=wpcs_send_email and attacker-supplied recipient, subject, and body parameters — no login, nonce, or cookie needed because the handler is registered on wp_ajax_nopriv_wpcs_send_email. The request succeeds and wp_mail() dispatches the email from the victim site's domain. The attacker scripts this at scale across thousands of victim sites to run phishing or spam campaigns that appear to originate from legitimate, unrelated businesses, degrading the sending reputation and deliverability of every one of those domains once mail providers start blacklisting them.

Weaknesses (CWE)

CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.