CVE-2026-15610

MediumCVSS 4.3/10Last modified Jul 16, 2026

Description

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger arbitrary re-embedding of stored RAG documents, modifying the rag_documents table and consuming the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jul 16, 2026
Last modified: Jul 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-156119.1Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s e CVE-2026-156129.1Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakenin CVE-2026-156147.5Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.CVE-2026-156157.5Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions in CVE-2026-156169.1Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unau CVE-2026-156179.1Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account acce CVE-2026-156186.3A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. The affected element is the function guardExecCommand of the file tools CVE-2026-156196.3A weakness has been identified in mosaxiv clawlet up to 0.2.10. The impacted element is the function web_fetch of the file tools/tool_web_fe CVE-2026-15624.8Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component CVE-2026-156206.3A security vulnerability has been detected in mosaxiv clawlet up to 0.2.10. This affects the function tools.webFetch of the file tools/tool_CVE-2026-156215.3A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file of the file tools/fs_CVE-2026-156225.3A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file of the file executor_manager/app/api/v1/