Quick answers
- Is CVE-2026-87918 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-87918 being exploited in the wild.
- How severe is CVE-2026-87918?
- Medium severity, with a CVSS score of 5.3, published 12 September 2026.
- Which products and versions are affected?
- WPBot WPBot before 8.5.7.
- Is there a fix for CVE-2026-87918?
- A patch was published on 2026-09-10: Fixed in version 8.5.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-87918 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-87918?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control (CWE-284) affecting multiple AJAX actions registered on the unauthenticated hook without nonce or capability checks. Affected actions (grok_response, and others) relay user prompts to third-party AI providers signed with stored API credentials. An attacker can send unauthenticated POST requests to /wp-admin/admin-ajax.php with any prompt text, triggering API calls that consume provider credits. No authentication, nonce, or prior user interaction is required; the only prerequisite is that the site administrator has configured at least one affected provider's API key (a common configuration for active WPBot installations). The vulnerability was patched in version 8.5.7.
Affected products
- WPBot WPBot before 8.5.7
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in version 8.5.7