CVE-2026-87916

Name of the Vulnerable Software and Affected Versions WPBot versions prior to 8.6.0

Description The plugin fails to perform capability or nonce checks on the AJAX action used to list stored chat sessions. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and comes from a trusted source. This flaw allows unauthenticated attackers to retrieve personally identifiable information, including the name, email address, and phone number of all chat visitors, by requesting a wide date range.

Recommendations Update WPBot to version 8.6.0 or later.