CVE-2026-16774— WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action
Possible ATT&CK Techniques 2AI
T1534 · Internal Spearphishing T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| quantumcloud | WPBot – AI ChatBot for Live Support, Lead Generation, AI Services | ≤ 8.5.9 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16774
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| quantumcloud | WPBot – AI ChatBot for Live Support, Lead Generation, AI Services | 0 ~ 8.5.9 | - |
II. Public POCs for CVE-2026-16774
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16774
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-16774 (1)
News Coverage for CVE-2026-16774 (1)
IV. Related Vulnerabilities
- CVE-2026-16773
WPBot <= 8.5.9 - Unauthenticated Sensitive Information Expos - CVE-2026-15610
WPBot <= 8.5.6 - Missing Authorization to Authenticated (Sub - CVE-2026-15106
WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Ar - CVE-2026-13731
WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting - CVE-2024-6669
AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (A
Same vendor: quantumcloud
- CVE-2026-16773
WPBot <= 8.5.9 - Unauthenticated Sensitive Information Expos - CVE-2026-61953
WordPress Simple Link Directory Pro plugin <= 15.0.6 - Serve - CVE-2026-61981
WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross - CVE-2026-15610
WPBot <= 8.5.6 - Missing Authorization to Authenticated (Sub - CVE-2026-15106
WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Ar
Same weakness: CWE-862
- CVE-2026-47127
Ghostfolio has a Stripe subscription bypass - CVE-2026-64676
Kata Containers: Unauthorized mem-agent ttRPC methods let an - CVE-2026-66061
Home Assistant: iOS Companion app forwards NFC/QR tag scans - CVE-2026-66060
Home Assistant: Unconfirmed NFC/QR tag scans allow silent au - CVE-2026-19017
Consul vulnerable to partial arbitrary file read via Vault C
V. Comments for CVE-2026-16774
No comments yet