CVE-2026-87959: WPBot missing capability check

CISO Take

The WPBot WordPress chatbot plugin (before 8.7.6) fails to check user capabilities on the AJAX action that saves its Claude AI provider settings, so any logged-in subscriber can overwrite the configuration, including the API key used for outgoing AI requests. Although the CVSS score is only medium (5.4) and EPSS is low (0.0023, though in the top 87th percentile), a public PoC exists and the attack needs nothing more than a low-privilege account, which is trivial to obtain on sites with open registration. CISA SSVC rates it TRACK and it is not in KEV, so there is no evidence of active exploitation yet. The real risk is that an attacker can replace the key to redirect prompts and chat content to an attacker-controlled account or endpoint, and can disrupt the chatbot or run up costs. Upgrade WPBot to 8.7.6 or later, rotate the Claude API key if any untrusted users could have registered, and review recent changes to the plugin's provider settings.

Sources:NVDEPSSATLASwpscan.com

What is the risk?

Medium overall. Exploitation is low-complexity, network-reachable and needs only subscriber-level access, with a public PoC available. The impact is limited to confidentiality and integrity of the plugin's AI provider configuration (CVSS C:L/I:L, no availability impact). Exposure is greatest on WordPress sites that allow open user registration or have many low-privilege accounts. No KEV listing and low EPSS suggest limited in-the-wild exploitation at present. This CVE is one of 14 affecting the same package, which points to a recurring weakness in the plugin's access control.

How does the attack unfold?

Initial Access

Attacker registers or obtains a subscriber-level account on the target WordPress site.

AML.T0012

Exploitation

Attacker calls the unprotected WPBot AJAX action that saves Claude provider settings, bypassing the missing capability check.

AML.T0049

Configuration Tampering

Attacker overwrites the Claude API key and related provider settings with attacker-controlled values.

AML.T0081

Impact

Chatbot prompts and conversations are exposed or redirected, or the AI service is disrupted, causing data exposure and cost impact.

Initial Access

Attacker registers or obtains a subscriber-level account on the target WordPress site.

AML.T0012

Exploitation

Attacker calls the unprotected WPBot AJAX action that saves Claude provider settings, bypassing the missing capability check.

AML.T0049

Configuration Tampering

Attacker overwrites the Claude API key and related provider settings with attacker-controlled values.

AML.T0081

Impact

Chatbot prompts and conversations are exposed or redirected, or the AI service is disrupted, causing data exposure and cost impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
WPBot	pip	—	No patch
WPBot	pip	—	No patch

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Update WPBot to version 8.7.6 or later. 2) Review the plugin's Claude provider settings for unexpected changes to the API key or other options, and rotate the Claude API key if there is any doubt. 3) Disable open user registration or restrict the default role if it is not required. 4) Audit subscriber-level accounts for suspicious or recently created users. 5) Monitor admin-ajax.php requests from low-privilege sessions that target WPBot settings-saving actions, and watch Anthropic API usage and billing for anomalies. 6) Use a WAF rule to block the vulnerable AJAX action for non-admin users until the patch is applied.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakagePluginAPIAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0081- Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies and procedures for third-party AI risk

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-87959?

The WPBot WordPress chatbot plugin (before 8.7.6) fails to check user capabilities on the AJAX action that saves its Claude AI provider settings, so any logged-in subscriber can overwrite the configuration, including the API key used for outgoing AI requests. Although the CVSS score is only medium (5.4) and EPSS is low (0.0023, though in the top 87th percentile), a public PoC exists and the attack needs nothing more than a low-privilege account, which is trivial to obtain on sites with open registration. CISA SSVC rates it TRACK and it is not in KEV, so there is no evidence of active exploitation yet. The real risk is that an attacker can replace the key to redirect prompts and chat content to an attacker-controlled account or endpoint, and can disrupt the chatbot or run up costs. Upgrade WPBot to 8.7.6 or later, rotate the Claude API key if any untrusted users could have registered, and review recent changes to the plugin's provider settings.

Is CVE-2026-87959 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-87959, increasing the risk of exploitation.

How to fix CVE-2026-87959?

1) Update WPBot to version 8.7.6 or later. 2) Review the plugin's Claude provider settings for unexpected changes to the API key or other options, and rotate the Claude API key if there is any doubt. 3) Disable open user registration or restrict the default role if it is not required. 4) Audit subscriber-level accounts for suspicious or recently created users. 5) Monitor admin-ajax.php requests from low-privilege sessions that target WPBot settings-saving actions, and watch Anthropic API usage and billing for anomalies. 6) Use a WAF rule to block the vulnerable AJAX action for non-admin users until the patch is applied.

What systems are affected by CVE-2026-87959?

This vulnerability affects the following AI/ML architecture patterns: WordPress AI chatbot plugins, LLM API integrations, Customer-facing conversational assistants.

What is the CVSS score for CVE-2026-87959?

CVE-2026-87959 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

WordPress AI chatbot pluginsLLM API integrationsCustomer-facing conversational assistants

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0081Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.

Exploitation Scenario

An attacker registers a subscriber account on a WordPress site that allows open registration, then sends a crafted request to admin-ajax.php invoking the WPBot action that saves Claude provider settings. Because no capability check is performed, the request succeeds and the attacker replaces the API key or related configuration with values they control. The site's chatbot then sends visitor prompts and conversation content through the attacker's configuration, or stops working. The attacker can harvest the conversation data or cause service disruption and cost impact for the site owner.