PT-2026-90590 · Undefined · Undefined
CVSS v3.1
5.3
متوسطة
| المتجه | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
WPBot versions prior to 8.5.7
Description
The plugin fails to perform authorization or nonce checks on several AJAX actions used to relay prompts to configured AI providers. This allows unauthenticated attackers to trigger third-party API calls using the site's configured API keys, leading to unauthorized consumption of the associated costs.
Recommendations
Update WPBot to version 8.5.7 or later.
استغلال
إصلاح
Improper Access Control
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Undefined