CyberRota Analysis
AI-GeneratedThe Chatbot plugin for WordPress versions up to 8.5.9 is vulnerable due to a lack of authorization checks in the wpcs_send_email() AJAX handler, allowing unauthenticated attackers to send arbitrary emails using the site's domain. This vulnerability can lead to spam and phishing attacks, potentially resulting in the site's IP or domain being blacklisted. WordPress site administrators using this plugin should prioritize applying patches or updates to mitigate the risk of abuse.
Original NVD Description
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.