WordPress Plugin Vulnerabilities

AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant

Description

The plugin does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.

Proof of Concept

Affects Plugins

Plugin icon
ai-engine
Fixed in 3.7.2

References

CVE
CVE-2026-75798

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Abdullah Kareem
Submitter
Abdullah Kareem
Submitter website
https://cyberkareem.com
Submitter twitter
cyberkareem
Verified
Yes
WPVDB ID
a77168df-61b8-40df-95f5-e19cf6540ce5

Timeline

Publicly Published
2026-08-24 (about 3 days ago)
Added
2026-08-24 (about 2 days ago)
Last Updated
2026-08-24 (about 2 days ago)

Other

Published
Title
Published
2026-06-29
Title
WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation
Published
2026-06-29
Title
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration < 4.3.8 - Missing Authorization
Published
2025-06-23
Title
Abandoned Contact Form 7 < 2.9 - Missing Authorization
Published
2026-05-11
Title
iPOSpays Gateways WC <= 1.3.7 - Unauthenticated Missing Authorization to Settings Update via REST API Endpoint
Published
2025-12-25
Title
Frontend Post Submission Manager Lite < 1.2.7 - Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletion