CVE-2026-75796
Received Received - Intake

Unauthorized Account Takeover in AI Engine WordPress Plugin

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: WPScan

Description
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-75796
EUVD
EUVD-2026-63824

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ai_engine ai_engine to 3.6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation flaw in the AI Engine WordPress plugin versions 2.8.0 to 3.6.0. It allows an Administrator on a Multisite sub-site to take over any account on the network, including the Network Administrator's account. The plugin fails to verify if the requesting user is authorized to perform privileged user management operations on the targeted account.

Detection Guidance

Check the installed version of the AI Engine plugin in WordPress. If it is between 2.8.0 and 3.6.0, the system is vulnerable. Look for unauthorized account modifications or privilege escalations in the WordPress Multisite environment.

Impact Analysis

An attacker with Administrator access to a sub-site could gain control over any account on the WordPress Multisite network, including the Network Administrator. This could lead to complete site takeover, data breaches, or unauthorized modifications to the entire network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. It may result in data breaches, unauthorized data exposure, and failure to maintain proper access controls.

Mitigation Strategies

Update the AI Engine plugin to version 3.6.1 or later immediately. Review user roles and permissions in the WordPress Multisite network for any suspicious changes. Monitor for unauthorized account access or modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75796. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart