CVE-2026-6803

Name of the Vulnerable Software and Affected Versions AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.13

Description The plugin contains a missing authorization flaw resulting from the absence of capability checks and nonce verification on AJAX actions registered under wp ajax and wp ajax nopriv hooks. This occurs because the base controller's getPermissions() function returns an empty array and the removeGroup and clear methods are not included in getNoncedMethods(), causing the authorization gate to unconditionally allow these actions. Consequently, unauthenticated attackers can delete specific records by ID or wipe all records from any module's database table.

Recommendations Update the plugin to a version later than 1.4.12. As a temporary mitigation, restrict access to the removeGroup and clear functions.