CyberRota Analysis
AI-GeneratedThe WPBot WordPress plugin prior to version 8.5.7 is vulnerable due to a lack of authorization and nonce checks on multiple AJAX actions, enabling unauthenticated attackers to exploit the plugin by making unauthorized API calls to third-party AI providers. This can lead to unauthorized consumption of the site's API keys, potentially incurring costs for the site owner. WordPress administrators using the WPBot plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.