What happened
The WPBot WordPress plugin before version 8.5.7 does not perform authorization or nonce checks on several AJAX actions that relay prompts to its configured AI providers (e.g., OpenAI). This allows unauthenticated attackers to trigger third-party AI API calls billed to the site owner's configured API key/account, without needing credentials.
Why it matters
While low in technical severity, this is a direct financial-abuse vector against any WordPress site running WPBot with a connected AI provider account — attackers can drive unbounded API spend on the victim's account with no authentication required.
Attack vector
Unauthenticated attacker sends crafted AJAX requests to WPBot endpoints lacking nonce/authorization checks, causing the plugin to relay attacker-supplied prompts to the site's configured AI provider API, consuming the owner's API quota/cost.
Affected systems
WPBot WordPress plugin < 8.5.7
Mitigation
Upgrade to WPBot 8.5.7 or later, which adds authorization and nonce validation to the affected AJAX actions.