CVE-2026-112828

AI Engine WordPress plugin authorization bypass

Meow Apps · AI Engine WordPress plugin

First documented disclosure · Review checkpoint

Summary

A user with Contributor privileges can bypass an authorization check in the AI Engine plugin.

Severity and exploitation evidence

Medium · 4.3/10 · CVSS 3.1. Severity source.

Exploitation not established: Real-world malicious exploitation is not established by the reviewed primary sources; a vulnerability report or public demonstration is not evidence of a victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Missing authorization permits an action beyond the caller’s assigned access level; the public advisory does not name the affected endpoint or action.

Conditions required

An authenticated WordPress account with Contributor privileges and an affected plugin release.

Potential impact

The CNA rates low integrity impact, with no confidentiality or availability impact in its CVSS vector. Specific altered objects are not disclosed.

Affected versions and configurations

All versions through 3.8.6.

Fix and mitigation status

3.8.7.

Practical next steps

Update AI Engine to 3.8.7 or a later supported release and review users with content-contributor access.

Operating lesson

Every AI plugin action needs server-side authorization, even when its caller can already publish ordinary content.

Evidence and limits

Public disclosure is October 26; October 15 was the private report. Patchstack’s operational priority label is Low, but the CNA CVSS 3.1 severity is Medium (4.3). Generic vulnerability-type text is not evidence of this flaw exposing other users’ data.

Sources