Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-16774— WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

Quick assessment

Affected
quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Chatbot 插件在 8.5.9 及以下版本中存在缺乏身份验证的漏洞。该漏洞通过 wpcs_send_email() AJAX 处理器利用。由于 wpcs_send_email() 函数在 wp_ajax_wpcs_send_email 和 wp_ajax_nopriv_wpcs_send_email 中注册，但既没有验证 nonce，也没有进行权限检查或速率限制，同时直接将攻击者控制的收件人、主题和内容转发到 wp_mail()，因此未认证的攻击者可以随意发送来自该网站域名的任意邮件给任

CVSS 5.3 · Medium EPSS 0.40% · P32

Affected Version Matrix 1

VendorProduct Version RangeStatus
quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services ≤ 8.5.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-16774

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services 0 ~ 8.5.9 -

II. Public POCs for CVE-2026-16774

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-16774

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-16774 (1)

News Coverage for CVE-2026-16774 (1)

IV. Related Vulnerabilities

Same product: WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
Same vendor: quantumcloud
Same weakness: CWE-862

V. Comments for CVE-2026-16774

No comments yet

Leave a comment