{"data":{"id":"ce2207d0-fa39-49fd-83a9-19443cb8254c","title":"CVE-2026-111372: The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up…","summary":"The AI ChatBot for WooCommerce – WoowBot plugin for WordPress, in all versions up to and including 5.0.0, fails to verify that a user is authorized to perform an action. Authenticated attackers with subscriber-level access or above can repeatedly trigger RAG document sync operations, which issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key. The wp_chatbot nonce needed to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, so any subscriber-level account can obtain it.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111372","publishedAt":"2026-10-28T07:16:47.137Z","cveId":"CVE-2026-111372","cweIds":["CWE-862"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI","Google","xAI"],"affectedVendorsRaw":["WoowBot","AI ChatBot for WooCommerce","OpenAI API","Gemini API","OpenRouter","xAI API"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG sync","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-28T12:08:30.225Z","kevDateAdded":null,"advisoryAliases":["GHSA-7vq9-r7c4-w548"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-28T12:08:33.240Z","patchAvailable":null,"disclosureDate":"2026-10-28T07:16:47.137Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability","confidentiality"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}