CVE-2026-14189 WPBot CVE debrief

Who should care

Administrators of WordPress sites using the WPBot plugin should update to version 8.5.2 or later to prevent SQL injection attacks. Additionally, security teams and vulnerability management teams should review the official advisory and assess their exposure to this vulnerability.

Technical summary

The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query. This allows users with administrator access to perform SQL injection that executes when a visitor triggers a search. The vulnerability is caused by a lack of input validation, allowing attackers to inject malicious SQL code.

Defensive priority

High

Recommended defensive actions

• Update WPBot plugin to version 8.5.2 or later
• Restrict administrator access to sensitive areas
• Monitor for suspicious search activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited. Official CVE and NVD records confirm the vulnerability. WPScan reported the issue. The vulnerability affects WordPress sites using the WPBot plugin before version 8.5.2. Defenders should verify the plugin version and review the official advisory for affected scope and severity.

Official resources