WPBot exposes stored chat sessions and can email transcripts to an attacker

WPBot through 8.5.9 registers both qcld_chatbot_session_date_filter and wpbot_send_email_transcript for unauthenticated admin-ajax use without a nonce or capability check. An unauthenticated attacker can submit start_date and end_date to qcld_chatbot_session_date_filter_free() and receive rows from wpbot_user, including session identifiers and stored user data, then submit a selected session plus an attacker-controlled email to wpbot_send_email_transcript_free(). That function reads the matching wpbot_user and wpbot_conversation rows and sends the full transcript with wp_mail() to the supplied address, exposing chat content and associated PII. Version 8.6.0 removes both nopriv registrations, requires manage_options plus an AJAX nonce, and sends transcripts only to the address stored for the session.