{"data":{"id":"faa07573-ca61-4969-9d89-2e1814fba484","title":"CVE-2026-87959: The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI…","summary":"The WPBot WordPress plugin before 8.7.6 lacks a capability check on the AJAX action that saves its Claude AI provider settings. Users with subscriber-level access can therefore overwrite those settings, including the API key used for the plugin's outgoing AI requests.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87959","publishedAt":"2026-09-16T06:16:35.610Z","cveId":"CVE-2026-87959","cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Anthropic"],"affectedVendorsRaw":["WPBot WordPress plugin","Claude AI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"WPBot WordPress plugin missing capability check on AJAX action","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0023,"epssCheckedAt":"2026-11-04T06:10:14.105Z","kevDateAdded":null,"advisoryAliases":["GHSA-j6fr-jm3x-jjr8"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T00:10:45.097Z","patchAvailable":null,"disclosureDate":"2026-09-16T06:16:35.610Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}