CVE-2026-111372

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeatedly trigger RAG document sync operations that issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key, draining their AI API credits and causing financial loss. The wp_chatbot nonce required to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, making it trivially obtainable by any subscriber-level account.

• CWE-862

• https://plugins.trac.wordpress.org/browser/woowbot-woocommerce-chatbot/tags/5.0.0/includes/class-qcld-bot-rag.php#L27
• https://plugins.trac.wordpress.org/browser/woowbot-woocommerce-chatbot/tags/5.0.0/includes/class-qcld-bot-rag.php#L816
• https://plugins.trac.wordpress.org/browser/woowbot-woocommerce-chatbot/tags/5.0.0/qcld-woowbot.php#L331
• https://plugins.trac.wordpress.org/browser/woowbot-woocommerce-chatbot/tags/5.0.1/includes/class-qcld-bot-rag.php#L816
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3408f728-48e9-4f96-98d4-748f51686e26?source=cve

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111366cool-admin-midway through 8.0.0 contains an authorization by…7.2
• CVE-2026-111367BillionMail through 4.9 contains a hard-coded cryptographic …6.5
• CVE-2026-111368ClassroomIO through 1.0.0 contains an insecure direct object…6.4
• CVE-2026-111369ClassroomIO through 1.0.0 contains an incorrect authorizatio…7.1
• CVE-2026-11137Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7…6.5
• CVE-2026-111370The WP Visitor Statistics (Real Time Traffic) plugin for Wor…7.2
• CVE-2026-111373FreeRDP before 3.32.0 contains a NULL pointer dereference vu…7.5
• CVE-2026-111374FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaus…5.3
• CVE-2026-111375FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds r…9.1
• CVE-2026-111376FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bou…5
• CVE-2026-111377FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reass…6.5
• CVE-2026-111378FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled re…7.5