CVE-2026-16954
Received Received - Intake

Information Exposure in AI Engine WordPress Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-16954
EUVD
EUVD-2026-53726

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ai_engine wordpress_plugin to 3.6.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The AI Engine WordPress plugin before version 3.6.4 exposes secret configuration values in an admin page's inline script data without redaction. This allows users with the Editor role to view stored third-party API keys and authentication tokens in cleartext, even though these secrets are restricted to administrators elsewhere.

Detection Guidance

Check if the AI Engine WordPress plugin version is below 3.6.4. Inspect admin page inline scripts for exposed secret configuration values like third-party API keys or authentication tokens.

Impact Analysis

Attackers with Editor role access could steal sensitive API keys and authentication tokens, leading to unauthorized access to third-party services, data breaches, or further exploitation of the WordPress site.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health data security) by exposing sensitive credentials, potentially resulting in unauthorized data access and regulatory penalties.

Mitigation Strategies

Update the AI Engine WordPress plugin to version 3.6.4 or later to address the sensitive data exposure issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16954. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart