Executive brief
WPBot, a popular AI chatbot plugin for WordPress, contains a security flaw that allows low-level users (such as subscribers) to modify the chatbot's configuration. This could allow an unauthorized person to change how the chatbot retrieves information or interacts with website visitors. The issue has been resolved in version 8.2.0 of the plugin.
Technical details
The WPBot AI ChatBot plugin for WordPress (versions prior to 8.2.0) is vulnerable to a missing authorization check in its 'qcld_rag_settings_option' AJAX handler. The affected component fails to implement both nonce verification and capability checks (such as 'manage_options'), which are correctly present in neighboring handlers. An authenticated attacker with subscriber-level privileges can send a crafted POST request to 'admin-ajax.php' to overwrite RAG configuration options, including embedding settings and source strings, in the database. This vulnerability is fixed in version 8.2.0.
Affected products
- Unknown WPBot AI ChatBot < 8.2.0
Timeline
- 2026-06-30: disclosed: Publicly published by WPScan
- 2026-07-21: advisory: NVD published date