WordPress Plugin Vulnerabilities

AI Engine – The Chatbot, AI Framework & MCP for WordPress < 3.5.0 - Editor+ Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation, making it possible for authenticated attackers with Editor-level access and above to elevate their privileges.

Affects Plugins

Plugin icon
ai-engine
Fixed in 3.5.0

References

CVE
CVE-2026-27407
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b73edf8f-7017-4239-8ddc-038481d3f65f

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Phat RiO
Verified
No
WPVDB ID
8b1751f2-f007-45df-897c-3b5dbde1120d

Timeline

Publicly Published
2026-05-28 (about 4 months ago)
Added
2026-06-02 (about 4 months ago)
Last Updated
2026-06-02 (about 4 months ago)

Other

Published
Title
Published
2021-07-20
Title
HM Multiple Roles < 1.3 - Arbitrary Role Change
Published
2025-05-06
Title
WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Published
2025-03-18
Title
Service Finder Bookings < 5.1 - Unauthenticated Privilege Escalation via Account Takeover
Published
2026-10-05
Title
Doctreat Core <= 1.7.0 - Unauthenticated Privilege Escalation
Published
2018-05-29
Title
Woocommerce Category Banner Management <= 1.1.0 - Unauthenticated Settings Change