Description

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T06:16:28.317Z",
  "pubdate": "2026-09-12T06:16:28.317Z",
  "executiveSummary": "The WPBot WordPress plugin, in versions prior to 8.6.0, contains an insecure AJAX implementation that results in an Unauthenticated Sensitive Information Disclosure vulnerability.\nThe vulnerability originates from a lack of capability verification and nonce validation within the plugin's chat session listing functionality. This design flaw allows unauthenticated remote attackers to query the backend and retrieve PII (Personally Identifiable Information) stored in chat logs.\nImpacted data fields include the visitor's full name, email address, and phone number. By submitting a crafted request specifying a broad date range, an attacker can programmatically exfiltrate the entire history of chat interactions stored by the plugin.\nThis vulnerability poses a significant privacy risk and potential compliance violation, as it allows unauthorized access to user-provided contact information without requiring any interaction or authentication from the legitimate site administrator.\nThe attack is remotely exploitable over the network, requiring no specific privileges or valid session tokens to execute.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of WordPress AJAX action handlers within the WPBot plugin. Specifically, the function responsible for retrieving chat sessions fails to implement security checks, such as current_user_can() for authorization control and check_ajax_referer() for Cross-Site Request Forgery (CSRF) protection.\nIn the WordPress ecosystem, AJAX actions must be explicitly protected to ensure that only authorized users can trigger sensitive server-side operations. By failing to validate the request origin via nonces and failing to verify the user's capability level, the plugin leaves the data-fetching endpoint exposed to the public.\nThe attack flow begins when an unauthenticated actor sends an HTTP POST request to the WordPress admin-ajax.php endpoint. The payload includes the specific action identifier corresponding to the chat session retrieval function. Because there is no authentication gate, the backend process accepts the request regardless of the user's session status.\nThe attacker can manipulate the parameters of the request—specifically the date-range arguments—to widen the scope of the database query. By requesting a large or arbitrary date range, the attacker bypasses any implicit limitations intended for legitimate administrators. The backend application then executes an SQL-like retrieval operation and returns the resulting chat data in a structured format, typically JSON.\nThe returned data object includes sensitive PII such as names, email addresses, and phone numbers associated with past chat interactions. Because this process is automated and does not require elevated privileges, an attacker can perform bulk exfiltration of the site's entire chat history. This leads to a severe loss of data confidentiality, exposing the user base to potential phishing, identity theft, or data privacy breaches.\nThis vulnerability affects all WPBot installations prior to version 8.6.0. The lack of input validation and authentication checks constitutes a critical failure in secure coding practices for WordPress plugin development, specifically concerning the handling of administrative AJAX hooks."
}