Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

WP-Chatbot for Messenger plugin authorization bypass in all versions up to 4.9

CVE-2026-3506 · published 5 months ago
Summary

The WP-Chatbot for Messenger plugin has a bug that lets anyone change sensitive settings without logging in. This could allow hackers to take control of your chatbot and redirect conversations to their own account. Update to the latest version (5.0 or higher) to fix this issue.

Original advisory text
The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9. This is due to the plugin not properly verifying that a user is au...
The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the site's MobileMonkey API token and company ID options, which can be used to hijack chatbot configuration and redirect visitor conversations to an attacker-controlled MobileMonkey account.
References
Severity
5.3 Medium
CVSS 3.1: 5.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-862Missing Authorization
Timeline
Published21 Mar 2026
Updated15 Aug 2026
First seen21 Mar 2026
Sources
CVE-2026-3506 · NVD
Monitor software like this
Free during beta