WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services <= 8.8.8 - Unauthenticated Missing Authentication via Predictable Automator Webhook Trigger Identifier
- ID
- WPSEC-2026-1842
- Plugin
- WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services (chatbot)
- Affected
- all versions before 8.8.9
- Remediation
- Update to 8.8.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-306
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services on WPSec AttackSurface
- Fix released
- Published
Description
The WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services plugin for WordPress is vulnerable to unauthorized workflow execution via the bundled Automator add-on's public incoming-webhook endpoint in all versions up to, and including, 8.8.8. The endpoint has no permission check and treats the workflow's trigger node identifier as its only secret, but workflows created from the add-on's built-in templates all use the same fixed identifier. This makes it possible for unauthenticated attackers to start an active webhook workflow on any affected site and supply the data its actions run on, such as sending email, calling external services and creating or changing site content. Sites with no active webhook-triggered workflow are not affected.
References
- https://wpsec.com/vuln/WPSEC-2026-1842/
- https://plugins.svn.wordpress.org/chatbot/tags/8.8.9/
- https://wordpress.org/plugins/chatbot/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS