Junglewise Threat Intelligence

CVE-2026-16774: QuantumCloud Chatbot missing authorization in wpcs_send_email AJAX handler

CVE-2026-16774 · Severity: medium · CVSS 5.3 · Published 2026-07-28

Technologies: QuantumCloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services. Vendors: QuantumCloud.

Executive brief

A vulnerability in the Chatbot plugin for WordPress allows unauthorized individuals to send emails through your website's server. This could be used by attackers to send spam or phishing messages that appear to come from your official domain. Such activity can damage your organization's reputation and lead to your website's IP address being blacklisted by email providers, disrupting legitimate communications.

Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the wpcs_send_email() AJAX handler. The function is registered for both authenticated and unauthenticated users (wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email) without any nonce verification, capability checks, or rate limiting. An attacker can provide arbitrary values for the recipient, subject, and body parameters, which are passed directly to the WordPress wp_mail() function. This allows for remote, unauthenticated email relaying. A patch was introduced in changeset 3621386.

Affected products

  • QuantumCloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services up to, and including, 8.5.9

Timeline

  • 2026-07-28: advisory: NVD publication date
  • 2026-07-28: disclosed: Wordfence advisory published

References

Related threats