CVE-2026-16774 in WPBot Plugin
Summary
by MITRE • 07/28/2026
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/28/2026
The Chatbot plugin for WordPress presents a critical security vulnerability classified as missing authorization within versions up to and including 8.5.9. This flaw resides in the wpcs_send_email() AJAX handler which exposes a dangerous pathway for unauthorized email transmission. The vulnerability stems from the improper registration of the wpcs_send_email() function on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email hooks without implementing essential security controls. The absence of nonce verification creates a fundamental weakness that allows attackers to forge legitimate requests without proper authentication. Additionally, no capability checks are enforced to verify user permissions or roles, meaning anyone can exploit this functionality regardless of their access level within the WordPress environment.
The technical implementation of this vulnerability creates a direct vector for email injection attacks through the wp_mail() function which receives attacker-controlled parameters including recipient addresses, email subjects, and message bodies. This design flaw enables unauthenticated attackers to leverage the site's legitimate mail infrastructure for malicious purposes while maintaining the appearance of legitimate communication from the domain. The lack of rate limiting mechanisms further compounds the issue by allowing unlimited email sending attempts, making it trivial for attackers to overwhelm recipients or conduct spam campaigns. This vulnerability maps directly to CWE-863, which addresses "Incorrect Authorization" and falls under the ATT&CK technique T1192, specifically targeting "Spoofing" through email manipulation.
The operational impact of this vulnerability extends beyond simple spam generation to encompass sophisticated phishing attacks and domain reputation damage. Attackers can craft convincing emails that appear to originate from the compromised WordPress site, potentially leading to credential theft or malware distribution. The ability to send emails to any recipient address creates opportunities for social engineering campaigns that exploit trust in legitimate domain communications. Furthermore, the excessive email volume generated by attackers can result in the site's IP address or domain being blacklisted by major email providers and security vendors, severely impacting the organization's email deliverability and online reputation. This vulnerability directly impacts the confidentiality and integrity of the WordPress installation's communication channels while potentially violating data protection regulations.
Mitigation strategies should focus on immediate patching of affected versions to version 8.6.0 or later where authorization controls have been implemented. Organizations should also consider implementing rate limiting measures at the web server level to restrict email sending frequency from individual IP addresses. Network-level firewalls can be configured to monitor and restrict unusual email traffic patterns originating from WordPress installations. Additionally, administrators should verify that no legitimate users require access to the vulnerable AJAX endpoints and implement proper capability checks before allowing any email transmission functionality. The implementation of nonce verification for all AJAX handlers provides an additional layer of protection against cross-site request forgery attacks while ensuring that only authenticated requests can trigger email sending operations.