CVE-2026-14189 WPBot CVE debrief

Who should care

Administrators of WordPress sites using the WPBot plugin should update to version 8.5.2 or later to prevent SQL injection attacks. Additionally, security teams and vulnerability management teams should review the official advisory and assess their exposure to this vulnerability.

Technical summary

The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query. This allows users with administrator access to perform SQL injection that executes when a visitor triggers a search. The vulnerability is caused by a lack of input validation, allowing attackers to inject malicious SQL code.

Defensive priority

High

Recommended defensive actions

• Update WPBot plugin to version 8.5.2 or later
• Restrict administrator access to sensitive areas
• Monitor for suspicious search activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited. Official CVE and NVD records confirm the vulnerability. WPScan reported the issue. The vulnerability affects WordPress sites using the WPBot plugin before version 8.5.2. Defenders should verify the plugin version and review the official advisory for affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.