{"data":{"id":"faa07573-ca61-4969-9d89-2e1814fba484","title":"CVE-2026-87959: The WPBot  WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI","summary":"The WPBot WordPress plugin (a tool that adds AI features to WordPress websites) before version 8.7.6 is missing a security check on one of its functions, allowing low-level users (subscribers) to change important settings including the API key (a secret credential used to access the Claude AI service). This means even basic users could potentially hijack the plugin's connection to the AI service.","solution":"Update WPBot WordPress plugin to version 8.7.6 or later.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87959","publishedAt":"2026-09-16T06:16:35.610Z","cveId":"CVE-2026-87959","cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Anthropic Claude","WPBot WordPress plugin"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-09-16T06:16:35.610Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":["AML.T0010"]}}