CVE-2026-12510

Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.5.5

Description An Insecure Direct Object Reference occurs when the plugin fails to verify if a user owns the chatbot conversation referenced by a client-supplied identifier. This allows authenticated users with subscriber-level access or higher to read private conversations belonging to other users and take over their conversation records when the discussions feature is enabled. This is caused by missing validation on a user-controlled key.

Recommendations Update to version 3.5.5 or later.