CVE-2026-87959

EUVD-2026-80212
The WPBot  WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot  WordPress plugin before 8.7.6's outgoing AI requests.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 13.91%
Common Weakness Enumeration
References
https://wpscan.com/vulnerability/3d42171d-6335-4bd3-bbed-fc446da3f945/