CVE-2026-110982
Deferred Deferred - Pending Action

WordPress AI Engine Plugin Privilege Escalation Vulnerability

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-110982
EUVD
EUVD-2026-107071

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown AI Engine 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The AI Engine WordPress plugin before version 3.8.6 has a vulnerability where it fails to verify if a user has permission to edit an object before allowing them to update its title and excerpt. This lets users with the Editor role or higher modify any post type, including restricted content like navigation menus, block templates, global styles, and WooCommerce coupons.

Detection Guidance

Check if the AI Engine WordPress plugin version is below 3.8.6. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details in the WordPress admin panel.

Impact Analysis

An attacker with Editor access could change titles and excerpts of sensitive content, potentially altering navigation, styles, or coupons. This could disrupt site functionality, mislead users, or cause unintended changes to critical elements like pricing or site structure.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized users to modify sensitive content such as navigation menus, block templates, global styles, and WooCommerce coupons. Unauthorized changes to such content may lead to data integrity issues, unauthorized disclosures, or violations of access control requirements mandated by these regulations.

Mitigation Strategies

Update the AI Engine plugin to version 3.8.6 or later immediately. Remove unnecessary user roles with Editor access or higher if they are not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110982. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...