# Post Snippets <= 4.2.4 - Authenticated (Subscriber+) Missing Authorization to AI Chatbot AJAX Actions

- **ID:** WPSEC-2026-1505
- **Plugin:** Post Snippets – Custom WordPress Code Snippets Customizer (`post-snippets`), https://wordpress.org/plugins/post-snippets/
- **Affected versions:** from 4.2.0 before 4.2.5
- **Fixed in:** 4.2.5 (Update to 4.2.5 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/post-snippets
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1505/

## Description

The Post Snippets plugin for WordPress is vulnerable to unauthorized access via the check_api_key and chatbot_ask AJAX actions in all versions up to, and including, 4.2.4, due to a missing capability check. The handlers only verify the 'chatbot_nonce' nonce, and that nonce is printed on every wp-admin page, including the profile page any logged-in user can open. This makes it possible for authenticated attackers, with subscriber-level access and above, to check whether an OpenAI API key is configured and to send arbitrary chat requests through the site's configured OpenAI API key, using up the site owner's API quota and credit.

## References

- https://wpsec.com/vuln/WPSEC-2026-1505/
- https://plugins.svn.wordpress.org/post-snippets/tags/4.2.5/
- https://wordpress.org/plugins/post-snippets/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1505/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.