CVE-2026-6639

Name of the Vulnerable Software and Affected Versions AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.7

Description An issue exists where the getCurrentTaskResults() function in modules/workspace/controller.php is accessible without authentication or authorization. This occurs because the function is missing from the getNoncedMethods() array, the getPermissions() function returns an empty array, and AJAX actions are registered using wp ajax nopriv hooks. Unauthenticated attackers can enumerate sequential task IDs to retrieve sensitive data from the JSON response, including plaintext OpenAI API keys, AI prompts, keywords, and full AI model configurations stored in the database.

Recommendations Update AI Chatbot & Workflow Automation by AIWU to a version newer than 1.4.6. As a temporary mitigation, restrict access to the getCurrentTaskResults() function in modules/workspace/controller.php to authorized users only.