CVE-2026-16773 in WPBot Plugin
Summary
by MITRE • 07/28/2026
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbot_send_email_transcript_free. This makes it possible for unauthenticated attackers to exfiltrate full chat transcripts and associated user PII — including names, email addresses, and phone numbers — stored in the wpbot_user and wpbot_conversation tables to an attacker-controlled email address.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The WPBot plugin for WordPress represents a significant security vulnerability through its exposure of sensitive user data via the wpbot_send_email_transcript_free functionality. This flaw affects all versions up to and including 8.5.9, creating a critical pathway for unauthorized data access that directly impacts user privacy and organizational compliance. The vulnerability stems from inadequate authentication checks within the plugin's email transcript sending mechanism, allowing any remote attacker to exploit this functionality without requiring valid credentials or administrative privileges.
The technical implementation of this flaw resides in the plugin's handling of chat transcript data transmission, where the wpbot_send_email_transcript_free function lacks proper access control validation. This oversight enables attackers to manipulate the system into sending complete conversation histories containing personal identifiable information directly to external email addresses controlled by malicious actors. The affected database tables wpbot_user and wpbot_conversation store comprehensive user interaction data including names, email addresses, phone numbers, and full chat histories that are systematically exposed through this vulnerability.
The operational impact of this information exposure creates substantial risk for organizations utilizing the WPBot plugin, as it enables comprehensive user profiling and potential identity theft operations. Attackers can harvest complete customer interaction histories, including sensitive personal data and communication patterns, which can be leveraged for social engineering attacks, phishing campaigns, or direct financial fraud. The vulnerability's unauthenticated nature means that no privileged access is required to exploit the flaw, making it particularly dangerous as it can be discovered and utilized by any attacker with knowledge of the plugin's functionality.
Security practitioners should immediately implement mitigation strategies including patching to versions beyond 8.5.9 where the vulnerability has been addressed, implementing network-level restrictions on plugin endpoints, and reviewing existing chat transcript data for potential exposure. This vulnerability aligns with CWE-200 (Information Exposure) and represents a clear violation of data protection principles under standards such as gdpr and ccpa. The attack pattern follows typical information disclosure techniques documented in the mitre ATT&CK framework under the information gathering category, specifically targeting credential dumping and data exfiltration phases that can lead to broader system compromise.
Organizations should conduct comprehensive security assessments of their WordPress installations to identify all instances of this vulnerable plugin and verify proper access controls have been implemented. Database access logging should be enhanced to detect unauthorized queries against the wpbot_user and wpbot_conversation tables, while network monitoring solutions should be configured to alert on suspicious email transmission patterns originating from web servers running vulnerable versions of the plugin. The exposure of full conversation histories creates a persistent risk that extends beyond immediate exploitation, as compromised data can be used for long-term targeted attacks against individuals and organizations.