CVE-2026-16954CWE-200information-disclosure

CVE-2026-16954

Medium · published August 6, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00429 · 36.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-08-06T11:16Z
References (1)
https://wpscan.com/vulnerability/badce355-e6ce-4dd4-8d9b-c87a7b9db12f/ · [email protected]
EPSS history
Timeline
  • 06 AUG 06:00Z
    AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens
    cvelistv5