CVE-2026-75798CWE-862broken-access-control

CVE-2026-75798

Medium · published August 26, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00304 · 21.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-26T10:16Z
References (1)
https://wpscan.com/vulnerability/a77168df-61b8-40df-95f5-e19cf6540ce5/ · [email protected]
EPSS history
Timeline
  • 27 AUG 06:45Z
    EPSS moved — → 0%
    epss
  • 26 AUG 06:00Z
    AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant
    cvelistv5