{"id":"CVE-2026-87959","aliases":["EUVD-2026-80212","GHSA-j6fr-jm3x-jjr8"],"status":"published","title":"WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update","description":"The WPBot  WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot  WordPress plugin before 8.7.6's outgoing AI requests.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0023,"percentile":0.13986,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-09-16T06:00:17Z","modified":"2026-09-17T15:33:19Z","products":[{"vendor":"unknown","product":"wpbot"}],"references":[{"url":"https://wpscan.com/vulnerability/3d42171d-6335-4bd3-bbed-fc446da3f945/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87959"},{"url":"https://wpscan.com/vulnerability/3d42171d-6335-4bd3-bbed-fc446da3f945"},{"url":"https://github.com/advisories/GHSA-j6fr-jm3x-jjr8"}],"sources":{"cve":[{"id":"CVE-2026-87959","title":"WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update","description":"The WPBot  WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot  WordPress plugin before 8.7.6's outgoing AI requests.","status":"published","published":"2026-09-16T06:00:17.359Z","modified":"2026-09-17T12:32:13.415Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:37:47.463822Z"}],"euvd":[{"id":"EUVD-2026-80212","description":"The WPBot  WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot  WordPress plugin before 8.7.6's outgoing AI requests.","status":"published","published":"2026-09-16T06:00:17Z","modified":"2026-09-17T12:32:13Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:13.536818Z"}],"ghsa":[{"id":"GHSA-j6fr-jm3x-jjr8","title":"The WPBot  WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action...","description":"The WPBot  WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot  WordPress plugin before 8.7.6's outgoing AI requests.","status":"published","published":"2026-09-16T06:31:36Z","modified":"2026-09-17T15:33:19Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:12:05.417571Z"}],"nvd":[{"id":"CVE-2026-87959","description":"The WPBot  WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot  WordPress plugin before 8.7.6's outgoing AI requests.","status":"published","published":"2026-09-16T06:16:35.61Z","modified":"2026-09-17T13:16:57.22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:48.287983Z"}]}}