What’s Vulnerable › Vulnerabilities
CVE-2026-15241: ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-02 · updated 2026-08-26
- Weakness: CWE-284
Description
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional feature is enabled, to retrieve indexed knowledge-base content.
Affected products
- AI ChatBot for WooCommerce: before 4.8.4 — fixed in 4.8.4
How to fix
Upgrade to a fixed version: AI ChatBot for WooCommerce 4.8.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-15241 or the next vulnerability affects your stack