PT-2026-81962

CVE-2026-75798

Published

2026-08-26

Updated

2026-08-26

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AI Engine versions 3.4.0 through 3.7.1

Description An authorization bypass exists in an administration-only feature of the AI Engine WordPress plugin. The system relies on a token provided to anonymous visitors instead of performing proper authorization checks. This allows unauthenticated attackers to execute arbitrary AI queries using the site owner's configured provider account.

Recommendations Update AI Engine to version 3.7.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Abdullah Kareem

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers