CVE-2026-87959

The WPBot WordPress plugin (versions 8.7.2 through 8.7.5, before 8.7.6) contains a missing capability check on the AJAX action responsible for saving its Claude AI provider settings . This allows users with as little as subscriber-level access to overwrite those settings, including the API key us...