Read the docs
TI-2026-78627 Aliases CVE-2026-110982GHSA-7phx-x376-59jf

Missing authorization in AI Engine WordPress plugin lets editors change posts

Priority LOW 22CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt. A user with the Editor role or above can change the title and excerpt of arbitrary posts of any type, including content they cannot otherwise edit, such as navigation menus and WooCommerce coupons. The flaw is classified as CWE-862 (missing authorization). Exploitation requires an authenticated attacker with high privileges, and the impact is limited to integrity.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed AI Engine (Unknown): 3.8.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAI Enginebefore 3.8.63.8.6Patch availableCNA
  • AI Engine VendorUnknown Affected before 3.8.6 Fixed in 3.8.6 Patch available CNA

Remediation

Update AI Engine to version 3.8.6, which fixes the flaw. The sources list no vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA AI Engine (Unknown) Fixed in 3.8.6

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-110982
  2. 2026-10-21 Alias added: GHSA-7phx-x376-59jf

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences