# WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services <= 8.8.8 - Unauthenticated Missing Authentication via Predictable Automator Webhook Trigger Identifier

- **ID:** WPSEC-2026-1842
- **Plugin:** WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services (`chatbot`), https://wordpress.org/plugins/chatbot/
- **Affected versions:** all versions before 8.8.9
- **Fixed in:** 8.8.9 (Update to 8.8.9 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-306
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/chatbot
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1842/

## Description

The WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services plugin for WordPress is vulnerable to unauthorized workflow execution via the bundled Automator add-on's public incoming-webhook endpoint in all versions up to, and including, 8.8.8. The endpoint has no permission check and treats the workflow's trigger node identifier as its only secret, but workflows created from the add-on's built-in templates all use the same fixed identifier. This makes it possible for unauthenticated attackers to start an active webhook workflow on any affected site and supply the data its actions run on, such as sending email, calling external services and creating or changing site content. Sites with no active webhook-triggered workflow are not affected.

## References

- https://wpsec.com/vuln/WPSEC-2026-1842/
- https://plugins.svn.wordpress.org/chatbot/tags/8.8.9/
- https://wordpress.org/plugins/chatbot/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1842/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.