CVE-2026-111372

WoowBot subscribers can trigger paid embedding calls without authorization

QuantumCloud · AI ChatBot for WooCommerce / WoowBot RAG sync

First documented disclosure · Review checkpoint

Summary

A subscriber can repeatedly trigger document synchronization billed to the site owner.

Severity and exploitation evidence

Medium · 4.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources do not establish malicious exploitation or a confirmed victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The manual RAG sync action checks a nonce but lacks the necessary authorization; the nonce is exposed to authenticated frontend visitors.

Conditions required

A subscriber-or-higher account and a configured paid embedding provider.

Potential impact

Potential depletion of AI API credits and financial loss through repeated embedding calls.

Affected versions and configurations

All versions through 5.0.0.

Fix and mitigation status

5.0.1.

Practical next steps

Upgrade, restrict RAG-sync capabilities and set provider usage limits.

Operating lesson

A request nonce does not grant authority to spend another user’s API budget.

Evidence and limits

Wordfence disclosed October 27; CNA publication followed October 28. OpenAI, Gemini, OpenRouter and xAI are listed billing targets, not breached providers. No actual loss amount or victim is reported.

Sources