5.3
Moyenne
CVE-2026-75798 The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only…
Description
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| AI Engine 3.4 | 3.4.0 → < 3.7.2 | 3.7.2 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de AI Engine
Les 14 CVE de AI Engine →
CVE-2026-110982
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object…
4.9
Moyenne
CVE-2026-111041
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management…
4.9
Moyenne
CVE-2026-110976
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs…
4.9
Moyenne
CVE-2026-75797
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local…
7.7
Élevée