CVE-2026-87918: WPBot unauthenticated AJAX abuse

Q: Is CVE-2026-87918 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-87918, increasing the risk of exploitation.

Q: How to fix CVE-2026-87918?

1) Patch: upgrade WPBot to version 8.5.7 or later immediately — this is the vendor fix per WPScan advisory. 2) Interim workaround if patching is delayed: disable the WPBot AI-relay feature, or place the site behind a WAF rule blocking unauthenticated POST requests to the plugin's `admin-ajax.php` actions associated with WPBot's AI functions. 3) Credential hygiene: rotate the configured AI provider API key after patching, and set hard spending/rate limits on that key at the provider (OpenAI, etc.) so future misuse is capped regardless of application-layer bugs. 4) Detection: review AI provider billing/usage logs for anomalous spikes in request volume or unusual source IPs correlated with `admin-ajax.php` access logs; alert on AI API usage that doesn't correlate with normal site traffic patterns. 5) Verify WordPress plugin update via `wp plugin list` or the admin dashboard and confirm no unauthenticated AJAX handlers remain reachable post-patch.

Q: What systems are affected by CVE-2026-87918?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/CMS integrations, LLM API access layers.

Q: What is the CVSS score for CVE-2026-87918?

CVE-2026-87918 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.19%.

CISO Take

WPBot, a WordPress plugin that relays prompts to third-party AI providers (e.g., OpenAI), fails to enforce any authorization or WordPress nonce check on the AJAX actions that trigger those relayed calls, so any unauthenticated visitor can invoke them directly. Because the plugin uses the site owner's own configured API key to make the upstream call, an attacker can script repeated, unauthenticated requests that silently consume the victim's paid AI API quota — a straightforward cost-harvesting play with no exploit code or scanner signature currently published (no CISA KEV listing, no EPSS score, no known PoC). The blast radius is any WordPress site running WPBot before 8.5.7 with an AI provider key configured, and severity data is not yet published (CVSS/EPSS N/A), so treat urgency as moderate-to-high given the trivial exploitation bar. Patch to WPBot 8.5.7 or later immediately; until then, monitor AI provider billing dashboards for anomalous request spikes and consider temporarily disabling AI-relay features or rotating/rate-limiting the configured API key at the provider side.

Sources: NVD ATLAS

What is the risk?

Exploitability is high — the flaw requires no authentication, no valid nonce, and no special crafting beyond a direct AJAX POST to the vulnerable actions, making this trivial for even unsophisticated attackers or bots to abuse at scale. Impact is primarily financial (uncontrolled third-party API billing) rather than data compromise, since the attacker gains the ability to invoke the AI relay but not necessarily to read prior conversation data or pivot further, though prompt content sent by the attacker is processed by the site's AI provider under its own credentials. Exposure is broad given WordPress's market share and WPBot's role as an AI chatbot plugin, but real-world severity ratings, EPSS, and exploit tooling are not yet available (all N/A), and it is not in CISA KEV, so this should be tracked as a real but not yet actively-weaponized risk. Overall risk: MEDIUM — trivial to exploit, but impact is bounded to cost/availability of the AI integration rather than broader system compromise.

How does the attack unfold?

Recon

Attacker fingerprints WordPress sites running the WPBot plugin (<8.5.7) with an AI provider integration configured.

AML.T0006

Exploitation

Attacker sends unauthenticated AJAX POST requests to WPBot's AI-relay actions in admin-ajax.php, bypassing the missing authorization/nonce check.

AML.T0049

AI Service Abuse

The plugin forwards the attacker's request to the configured third-party AI provider using the site owner's stored API key.

AML.T0096

Impact

Automated, repeated calls run up the victim's AI API bill or exhaust its quota, causing financial harm via cost harvesting.

AML.T0034

Recon

Attacker fingerprints WordPress sites running the WPBot plugin (<8.5.7) with an AI provider integration configured.

AML.T0006

Exploitation

Attacker sends unauthenticated AJAX POST requests to WPBot's AI-relay actions in admin-ajax.php, bypassing the missing authorization/nonce check.

AML.T0049

AI Service Abuse

The plugin forwards the attacker's request to the configured third-party AI provider using the site owner's stored API key.

AML.T0096

Impact

Automated, repeated calls run up the victim's AI API bill or exhaust its quota, causing financial harm via cost harvesting.

AML.T0034

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
WPBot	pip	—	No patch

Do you use WPBot? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I None

A None

What should I do?

1 step

1) Patch: upgrade WPBot to version 8.5.7 or later immediately — this is the vendor fix per WPScan advisory. 2) Interim workaround if patching is delayed: disable the WPBot AI-relay feature, or place the site behind a WAF rule blocking unauthenticated POST requests to the plugin's admin-ajax.php actions associated with WPBot's AI functions. 3) Credential hygiene: rotate the configured AI provider API key after patching, and set hard spending/rate limits on that key at the provider (OpenAI, etc.) so future misuse is capped regardless of application-layer bugs. 4) Detection: review AI provider billing/usage logs for anomalous spikes in request volume or unusual source IPs correlated with admin-ajax.php access logs; alert on AI API usage that doesn't correlate with normal site traffic patterns. 5) Verify WordPress plugin update via wp plugin list or the admin dashboard and confirm no unauthenticated AJAX handlers remain reachable post-patch.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Plugin API AML.T0034 - Cost Harvesting AML.T0034.000 - Excessive Queries AML.T0049 - Exploit Public-Facing Application AML.T0096 - AI Service API

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.3 - AI system operational controls

NIST AI RMF

MANAGE-2.1 - Resources required to manage AI risks are taken into account

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-87918?

WPBot, a WordPress plugin that relays prompts to third-party AI providers (e.g., OpenAI), fails to enforce any authorization or WordPress nonce check on the AJAX actions that trigger those relayed calls, so any unauthenticated visitor can invoke them directly. Because the plugin uses the site owner's own configured API key to make the upstream call, an attacker can script repeated, unauthenticated requests that silently consume the victim's paid AI API quota — a straightforward cost-harvesting play with no exploit code or scanner signature currently published (no CISA KEV listing, no EPSS score, no known PoC). The blast radius is any WordPress site running WPBot before 8.5.7 with an AI provider key configured, and severity data is not yet published (CVSS/EPSS N/A), so treat urgency as moderate-to-high given the trivial exploitation bar. Patch to WPBot 8.5.7 or later immediately; until then, monitor AI provider billing dashboards for anomalous request spikes and consider temporarily disabling AI-relay features or rotating/rate-limiting the configured API key at the provider side.

Is CVE-2026-87918 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-87918, increasing the risk of exploitation.

How to fix CVE-2026-87918?

1) Patch: upgrade WPBot to version 8.5.7 or later immediately — this is the vendor fix per WPScan advisory. 2) Interim workaround if patching is delayed: disable the WPBot AI-relay feature, or place the site behind a WAF rule blocking unauthenticated POST requests to the plugin's `admin-ajax.php` actions associated with WPBot's AI functions. 3) Credential hygiene: rotate the configured AI provider API key after patching, and set hard spending/rate limits on that key at the provider (OpenAI, etc.) so future misuse is capped regardless of application-layer bugs. 4) Detection: review AI provider billing/usage logs for anomalous spikes in request volume or unusual source IPs correlated with `admin-ajax.php` access logs; alert on AI API usage that doesn't correlate with normal site traffic patterns. 5) Verify WordPress plugin update via `wp plugin list` or the admin dashboard and confirm no unauthenticated AJAX handlers remain reachable post-patch.

What systems are affected by CVE-2026-87918?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin/CMS integrations, LLM API access layers.

What is the CVSS score for CVE-2026-87918?

CVE-2026-87918 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin/CMS integrationsLLM API access layers

MITRE ATLAS Techniques

AML.T0034 Cost Harvesting

AML.T0034.000 Excessive Queries

AML.T0049 Exploit Public-Facing Application

AML.T0096 AI Service API

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE-2.1

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.

Exploitation Scenario

An attacker scans WordPress sites (e.g., via Wappalyzer-style fingerprinting or direct plugin file probing) to identify installations running WPBot with an AI integration enabled. They then send repeated unauthenticated HTTP POST requests directly to `wp-admin/admin-ajax.php` with the vulnerable WPBot action parameters — no login, no nonce token required — each request triggering a real call to the site's configured LLM provider using the site owner's API key. The attacker automates this with a simple script to fire thousands of requests, running up the victim's AI API bill or exhausting a rate-limited quota, effectively achieving a cost-harvesting/denial-of-budget attack with zero authentication and no need for sophisticated AI/ML knowledge — only awareness of the plugin's AJAX action names.

Weaknesses (CWE)

CWE-284 Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.