What is GHSA-gpj8-3p6v-p7h3?

GHSA-gpj8-3p6v-p7h3 is a security advisory published by GitHub Security Advisories with Medium severity. The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the...

Which CVE IDs does GHSA-gpj8-3p6v-p7h3 cover?

GHSA-gpj8-3p6v-p7h3 covers the following CVE IDs: CVE-2026-87916. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gpj8-3p6v-p7h3?

GHSA-gpj8-3p6v-p7h3 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-gpj8-3p6v-p7h3MediumCVSS 5.3

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the...

Vendor

GitHub Security Advisories

Published

September 12, 2026

Last Modified

September 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-87916 →

📋 Description

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-87916
https://wpscan.com/vulnerability/31d65e66-10b1-467a-8b20-ecf4880359e0
https://github.com/advisories/GHSA-gpj8-3p6v-p7h3