The WPBot WordPress plugin versions before 8.6.0 omit capability and nonce checks on the AJAX action that lists stored chat sessions. An unauthenticated attacker can invoke the endpoint with a broad date range and receive the name, email address and phone number of every chat visitor. This leads to disclosure of personally identifiable information and is characterized by CWE‑200.

Any WordPress site that has installed WPBot in a release, specifically the 8.4.9 through 8.5.9 builds, is affected. The flaw resides only in the plugin’s AJAX interface; the core WordPress installation is not impacted.

The vulnerability is fully unauthenticated—an attacker only score is below 1 % and the CVSS score is 5.3 user is not presently listed in the CISA KEV catalog. Exploitation requires only a simple HTTP request to the affected endpoint, making the attack straightforward once a vulnerable site is identified.