SQL Injection Vulnerability in AI Chatbot & Workflow Automation Plugin for WordPress

CVE-2026-2993

What is CVE-2026-2993?

The AI Chatbot & Workflow Automation plugin for WordPress, specifically in versions up to and including 1.4.17, is susceptible to SQL Injection vulnerabilities due to inadequate escaping of user-supplied parameters. In the getListForTbl() function, the lack of robust preparation for the existing SQL queries can lead to the exploitation of these vulnerabilities. This allows unauthorized attackers to inject additional SQL commands, potentially compromising sensitive data stored in the database. While a partial mitigation was implemented in version 1.4.11, introducing a nonce check limited to administrators, users are strongly advised to upgrade to the latest version to fully protect against this risk.

References