Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
2 items
The AI ChatBot for WooCommerce – WoowBot plugin for WordPress, in all versions up to and including 5.0.0, fails to verify that a user is authorized to perform an action. Authenticated attackers with subscriber-level access or above can repeatedly trigger RAG document sync operations, which issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key. The wp_chatbot nonce needed to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, so any subscriber-level account can obtain it.
CVE-2026-15610 affects the WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress in all versions up to and including 8.5.6. The plugin does not properly verify that a user is authorized to perform an action, letting authenticated attackers with subscriber-level access and above trigger arbitrary re-embedding of stored RAG documents. This modifies the rag_documents table and consumes the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).