{
 "id": "WPSEC-2026-1505",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1505/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1505/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1505/index.md",
 "title": "Post Snippets <= 4.2.4 - Authenticated (Subscriber+) Missing Authorization to AI Chatbot AJAX Actions",
 "description": "The Post Snippets plugin for WordPress is vulnerable to unauthorized access via the check_api_key and chatbot_ask AJAX actions in all versions up to, and including, 4.2.4, due to a missing capability check. The handlers only verify the 'chatbot_nonce' nonce, and that nonce is printed on every wp-admin page, including the profile page any logged-in user can open. This makes it possible for authenticated attackers, with subscriber-level access and above, to check whether an OpenAI API key is configured and to send arbitrary chat requests through the site's configured OpenAI API key, using up the site owner's API quota and credit.",
 "plugin": {
  "slug": "post-snippets",
  "name": "Post Snippets",
  "full_name": "Post Snippets – Custom WordPress Code Snippets Customizer",
  "wordpress_org": "https://wordpress.org/plugins/post-snippets/",
  "advisories_url": "https://wpsec.com/vuln/plugin/post-snippets/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/post-snippets"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.2.0",
    "from_inclusive": true,
    "to": "4.2.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.2.0 before 4.2.5"
  ]
 },
 "introduced_in": "4.2.0",
 "fixed_in": "4.2.5",
 "remediation": "Update to 4.2.5 or later.",
 "fix_released": "2026-10-22T09:46:55+00:00",
 "published": "2026-10-23T10:46:09+00:00",
 "updated": "2026-10-23T07:10:14.023023+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1505/",
  "https://plugins.svn.wordpress.org/post-snippets/tags/4.2.5/",
  "https://wordpress.org/plugins/post-snippets/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/post-snippets",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-23"
 }
}