AJAX Authorization Flaw in AI ChatBot for WooCommerce WordPress Plugin
CVE-2026-15241
Currently unrated
What is CVE-2026-15241?
The AI ChatBot for WooCommerce plugin, prior to version 4.8.4, contains a critical vulnerability that lacks necessary authorization and nonce checks for specific AJAX actions. This security gap allows unauthenticated users to exploit the plugin by utilizing the site owner's stored third-party API key to send potentially fraudulent requests. Furthermore, if enabled, this vulnerability also allows unauthorized access to sensitive indexed knowledge-base content, posing a significant risk to the integrity and security of users' data.
Affected Version(s)
AI ChatBot for WooCommerce 0 < 4.8.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.