Authorization Bypass Vulnerability in AI ChatBot for WooCommerce by WordPress

CVE-2026-111372

What is CVE-2026-111372?

The AI ChatBot for WooCommerce – WoowBot plugin is susceptible to an authorization bypass flaw that affects all versions up to 5.0.0. This vulnerability arises from insufficient verification of user authorization, allowing authenticated attackers with subscriber-level access to exploit it. Specifically, these attackers can initiate RAG document sync operations that invoke paid API calls to platforms like OpenAI, Gemini, OpenRouter, or xAI using the site administrator's API key. This results in the unintentional depletion of AI API credits, leading to potential financial repercussions for the site owner, as the wp_chatbot nonce required to exploit this weakness is readily available to any authenticated frontend visitor.

References