CVE-2026-6803
Received Received - Intake

Missing Authorization in AIWU WordPress Plugin

Publication date: 2026-07-11

Last updated on: 2026-07-11

Assigner: Wordfence

Description
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wp_ajax_ and wp_ajax_nopriv_ hooks, as the base controller's getPermissions() returns an empty array and neither removeGroup nor clear are added to getNoncedMethods(), causing the authorization gate to unconditionally return true for these actions. This makes it possible for unauthenticated attackers to delete specific records by ID or delete all records from any module's database table by unauthenticated attackers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-11
Last Modified
2026-07-11
Generated
2026-07-11
AI Q&A
2026-07-11
EPSS Evaluated
N/A
NVD
CVE-2026-6803
EUVD
EUVD-2026-43134

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aiwu ai_chatbot_and_workflow_automation to 1.4.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress has a Missing Authorization vulnerability in all versions up to and including 1.4.12. This occurs because the plugin lacks proper capability checks and nonce verification on certain AJAX actions. Specifically, the base controller's getPermissions() method returns an empty array, and critical methods like removeGroup and clear are not included in the getNoncedMethods() list. As a result, the authorization gate always returns true for these actions, allowing unauthenticated attackers to perform actions they should not be able to.

This vulnerability enables unauthenticated attackers to delete specific records by ID or delete all records from any module's database table via these AJAX actions.

Impact Analysis

This vulnerability can allow unauthenticated attackers to delete data from the plugin's database tables. Specifically, attackers can delete individual records by ID or remove all records from any module's database table. This can lead to data loss and disruption of the plugin's functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart