MEDIUM
CVE-2026-87916
CVSS
5.3
Description
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
Weakness (CWE)
CWE-200
Information Exposure
EPSS Score
0.21%
Probability of exploitation in next 30 days
11.1th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.