CVE-2026-2993

Name of the Vulnerable Software and Affected Versions AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.18

Description The AI Chatbot & Workflow Automation by AIWU plugin for WordPress contains a flaw allowing unauthenticated attackers to append additional SQL queries to existing ones. This is caused by insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query within the getListForTbl() function. This can lead to the extraction of sensitive information from the database. SQL Injection is a technique where an attacker inserts malicious SQL code into a query to manipulate the database.

Recommendations Update to a version later than 1.4.17. As a temporary workaround, restrict access to the getListForTbl() function.