CVE-2026-14189 — WPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access …
Published: 2026-07-27 · CVSS: 3.8 · CVSS 3.1
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7