The WPBot plugin for WordPress contains a missing authorization flaw in the wpcs_send_email() AJAX handler. Because the handler is registered for both authenticated and unauthenticated requests and performs no nonce verification or capability check, any visitor can invoke it. The function forwards attacker‑controlled recipient, subject, and message to wp_mail(), allowing the attacker to send arbitrary emails from the site’s domain. This vulnerability can be abused for spam, phishing, or domain reputation damage.

WordPress sites that have the quantumcloud WPBot plugin version 8.5.9 or earlier installed are affected. The flaw resides in the wpbot‑chat‑sessions.php file, where the wpcs_send_email() function is hooked to both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email without verification.

The CVSS score of 5.3 indicates a moderate risk, and the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a simple POST or GET request to wp-admin/admin-ajax.php with the action parameter wpcs_send_email. An attacker can supply any recipient, subject, and body, resulting in an unauthenticated email relay. This missing authorization flaw directly maps to CWE‑862, emphasizing the need for proper access control.