Is CVE-2026-16774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16774 being exploited in the wild.

How severe is CVE-2026-16774?

Medium severity, with a CVSS score of 5.3, published 28 July 2026.

Which products and versions are affected?

QuantumCloud WPBot up to, and including, 8.5.9.

Is there a fix for CVE-2026-16774?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16774 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16774?

Check whether you run QuantumCloud WPBot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16774: QuantumCloud Chatbot missing authorization in wpcs_send_email AJAX handler

CVE-2026-16774 · Severity: medium · CVSS 5.3 · Published 2026-07-28

A vulnerability in the Chatbot plugin for WordPress allows unauthorized individuals to send emails through your website's server. This could be used by attackers to send spam or phishing messages that appear to come from your official domain. Such activity can damage your organization's reputation and lead to your website's IP address being blacklisted by email providers, disrupting legitimate communications.

Technologies: QuantumCloud WPBot. Vendors: QuantumCloud.

Quick answers

Is CVE-2026-16774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16774 being exploited in the wild.
How severe is CVE-2026-16774?: Medium severity, with a CVSS score of 5.3, published 28 July 2026.
Which products and versions are affected?: QuantumCloud WPBot up to, and including, 8.5.9.
Is there a fix for CVE-2026-16774?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16774 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16774?: Check whether you run QuantumCloud WPBot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the wpcs_send_email() AJAX handler. The function is registered for both authenticated and unauthenticated users (wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email) without any nonce verification, capability checks, or rate limiting. An attacker can provide arbitrary values for the recipient, subject, and body parameters, which are passed directly to the WordPress wp_mail() function. This allows for remote, unauthenticated email relaying. A patch was introduced in changeset 3621386.

Affected products

QuantumCloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services up to, and including, 8.5.9

Timeline

2026-07-28: advisory: NVD publication date
2026-07-28: disclosed: Wordfence advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.