Read the docs
TI-2026-81754 Aliases CVE-2026-111372GHSA-7vq9-r7c4-w548

WoowBot Missing Authorization in qcld_rag_manual_sync AJAX Action

Priority LOW 20CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The AI ChatBot for WooCommerce WoowBot plugin by quantumcloud for WordPress is affected in all versions up to and including 5.0.0. The plugin does not verify that a user is authorized to perform an action (CWE-862), so authenticated users with subscriber-level access or above can repeatedly trigger RAG document sync operations. Each sync issues paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key, which drains the administrator's AI API credits. The required nonce is given to every authenticated frontend visitor, so any subscriber-level account can obtain it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeatedly trigger RAG document sync operations that issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key, draining their AI API credits and causing financial loss. The wp_chatbot nonce required to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, making it trivially obtainable by any subscriber-level account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00268 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quantumcloudAI ChatBot for WooCommerce – WoowBotup to 5.0.0—No fix listedCNA
  • AI ChatBot for WooCommerce – WoowBot Vendorquantumcloud Affected up to 5.0.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for AI ChatBot for WooCommerce (WoowBot).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-111372
  2. 2026-10-28 Alias added: GHSA-7vq9-r7c4-w548
  3. 2026-10-29 CISA SSVC decision points changed

References

Other 5

  • TI-2024-06312 Simple Video Directory < 1.4.3 - Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
  • TI-2023-01552 ChatBot < 4.4.7 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
  • TI-2024-05388 Simple Video Directory < 1.4.4 - Contributor+ Stored XSS CVSS 3.1MEDIUM 6.1
  • TI-2023-01558 ChatBot < 4.4.9 - Unauthenticated Stored XSS CVSS 3.1MEDIUM 6.1
  • TI-2023-00958 ChatBot < 4.4.5 - Stored XSS via CSRF CVSS 3.1MEDIUM 6.1
  • TI-2023-01553 ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS CVSS 3.1MEDIUM 5.4
See all 95 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences