Quick answers
- Is CVE-2026-87916 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-87916 being exploited in the wild.
- How severe is CVE-2026-87916?
- Medium severity, with a CVSS score of 5.3, published 12 September 2026.
- Which products and versions are affected?
- WPBot WPBot 8.4.9 to 8.5.9.
- Is there a fix for CVE-2026-87916?
- A patch was published on 2026-09-12: Fixed in version 8.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-87916 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-87916?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a missing authentication and authorization check in the AJAX handler for the qcld_chatbot_session_date_filter action. The action is registered on both authenticated and unauthenticated AJAX hooks without capability checks or nonce verification, and directly echoes visitor records as JSON. An unauthenticated attacker can send a POST request with a wide date range (e.g., 1970-01-01 to 2099-12-31) to wp-admin/admin-ajax.php to retrieve a complete list of stored chat sessions including visitor IDs, session IDs, names, email addresses, and phone numbers. The vulnerability requires at least one chat session to have been captured. The issue is fixed in version 8.6.0.
Affected products
- WPBot WPBot 8.4.9 to 8.5.9
Timeline
- 2026-09-10: disclosed
- 2026-09-12: patched: Fixed in version 8.6.0