WPBot exposes an unauthenticated arbitrary email relay
WPBot through 8.5.9 registers wpcs_send_email() as both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email without a nonce, capability check or rate limit. An unauthenticated attacker can submit data[to], data[subject] and data[message] to admin-ajax.php?action=wpcs_send_email; the handler passes those values to wp_mail() using a sender address from the site's domain. This permits spam and phishing through the site and can damage its domain or IP reputation. Actual delivery remains dependent on the site's mail configuration. Version 8.6.0 removes logged-out access, requires manage_options and a nonce, and restricts recipients.
- Component
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Plugin slug
chatbot- Affected
- <= 8.5.9
- Safe version
8.6.0- Published
- Jul 28, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Jul 28, 2026 and is one of 27 known issues for this plugin.
Update, patch or deactivate.
Update WPBot to 8.6.0 or later. Review outbound mail and admin-ajax.php requests using action=wpcs_send_email, investigate unexpected recipients or message content, and address any resulting mail-provider or reputation blocks.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N