WPBot <= 8.5.9 Unauthenticated Sensitive Information Exposure (CVE-2026-16773)

Vulnerability Overview Vulnerability Name: WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action CVE ID: CVE-2026-16773 CVSS Score: 5.3 (Medium) Publication Date: July 27, 2026 Last Update Date: July 28, 2026 Researchers: Wordfence PRISM - Wordfence Affected Versions Affected Versions: WPBot <= 8.5.9 Vulnerability Type: Unauthenticated Sensitive Information Exposure Description: The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress versions 8.5.9 and earlier contain a sensitive information exposure vulnerability. Attackers can retrieve full chat transcripts and related user personal information (including name, email address, and phone number) stored in the and tables by exploiting the AJAX action. This data is then sent to an email address controlled by the attacker. Remediation Fixed Version: 8.6.0 Recommendation: Update to version 8.6.0 or later to fix this vulnerability. Other Related Vulnerabilities WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpbot_send_email AJAX Action - CVE ID: CVE-2026-16774 - CVSS Score: 5.3 - Publication Date: July 27, 2026 WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter - CVE ID: CVE-2026-15106 - CVSS Score: 5.3 - Publication Date: July 15, 2026 WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function - CVE ID: CVE-2026-15610 - CVSS Score: 4.3 - Publication Date: July 15, 2026 WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 - Unauthenticated Stored Cross-Site Scripting - CVE ID: CVE-2026-57363 - CVSS Score: 7.2 - Publication Date: July 6, 2026 WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting - CVE ID: CVE-2026-57362 - CVSS Score: 6.1 - Publication Date: July 1, 2026 WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter - CVE ID: CVE-2026-13731 - CVSS Score: 7.2 - Publication Date: June 30, 2026 WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.9.7 - Missing Authorization - CVE ID: CVE-2026-40788 - CVSS Score: 4.3 - Publication Date: April 23, 2026 WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection - CVE ID: CVE-2026-32499 - CVSS Score: 7.5 - Publication Date: March 20, 2026 ChatBot <= 7.7.3 - Missing Authorization - CVE ID: CVE-2025-62952 - CVSS Score: 4.3 - Publication Date: October 13, 2025 ChatBot <= 7.3.9 - Missing Authorization - CVE ID: CVE-2025-64277 - CVSS Score: 5.3 - Publication Date: October 12, 2025 Summary This page details multiple security vulnerabilities within the WPBot plugin, with the most critical being the unauthenticated sensitive information exposure vulnerability (CVE-2026-16773). Users are advised to update to version 8.6.0 or later as soon as possible to remediate these issues.

Goal Reached Thanks to every supporter — we hit 100%!

WPBot <= 8.5.9 Unauthenticated Sensitive Information Exposure (CVE-2026-16773)