CVE-2026-3506

Medium CVSS: 5.3

The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the site's MobileMonkey API token and company ID options, which can be used to hijack chatbot configuration and redirect visitor conversations to an attacker-controlled MobileMonkey account.

Vendor

Product

CWE

CWE-862

Yayın Tarihi

2026-03-21 04:17:27

Güncelleme

2026-03-23 14:32:02

Source Identifier

security@wordfence.com

KEV Date Added

Kategoriler

CWE-862 MEDIUM 2026

Referanslar

https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/admin/admin.php#L29 https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/admin/class-htcc-admin.php#L29 https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/inc/MobileMonkeyApi.php#L37 https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/inc/MobileMonkeyApi.php#L409 https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/inc/MobileMonkeyApi.php#L52 https://plugins.trac.wordpress.org/browser/wp-chatbot/tags/4.9/inc/class-ht-cc.php#L178 https://plugins.trac.wordpress.org/browser/wp-chatbot/trunk/inc/MobileMonkeyApi.php#L37 https://www.wordfence.com/threat-intel/vulnerabilities/id/32cce973-bc3b-45f1-ad4d-ff395d3a6c8e?source=cve