---
id: "CVE-2026-111372"
kind: "vulnerability"
aliases: ["CVE-2026-111372"]
title: "WordPress WoowBot plugin lets subscribers trigger paid AI embedding calls"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ai-chatbot", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["no-subscriber-accounts", "plugin-not-installed"]
published_at: "2026-10-28T07:16:47+00:00"
first_seen_at: "2026-10-28T07:31:38+00:00"
updated_at: "2026-10-28T07:33:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111372", "first_seen_at": "2026-10-28T07:31:38+00:00"}]
---

# WordPress WoowBot plugin lets subscribers trigger paid AI embedding calls

The AI ChatBot for WooCommerce (WoowBot) WordPress plugin, up to and including 5.0.0, fails to check authorization on its RAG document sync action. Any logged-in subscriber can repeatedly trigger embedding API calls billed to the site administrator's stored OpenAI, Gemini, OpenRouter or xAI key, draining AI credits.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WoowBot plugin version in the WordPress admin Plugins screen; versions `5.0.0` and below are affected.
- Review whether subscriber-level accounts can be created or exist on the site, since the attack needs only that role.

## Fix

- Update the WoowBot plugin to a version later than `5.0.0` once a patched release is available; the sources do not name the fixed version.
- Rotate the stored OpenAI, Gemini, OpenRouter or xAI API keys if abuse is suspected, and check provider billing for unexpected embedding usage.

## Timeline

- 2026-10-28T07:31:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111372

## From the sources

The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeatedly trigger RAG document sync operations that issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key, draining their AI API credits and causing financial loss. The wp_chatbot nonce required to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, making it trivially obtainable by any subscriber-level account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_