CVE-2026-39600— WordPress Aculect AI Companion plugin <= 0.8.1 - Unvalidated Redirects and Forwards vulnerability
Quick assessment
Affected
Mehul Gohil Aculect AI Companion
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Mehul Gohil 开发的 Aculect AI 伴侣（aculect-ai-companion）中存在一个“重定向到不受信任站点（开放重定向）”漏洞，该漏洞可导致钓鱼攻击。此问题影响 Aculect AI 伴侣：从 n/a 到 0.8.1 版本均存在该漏洞。
Possible ATT&CK Techniques 1 AI
T1566.001 · Spearphishing AttachmentAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mehul Gohil | Aculect AI Companion | ≤ 0.8.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-39600
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Aculect AI Companion plugin <= 0.8.1 - Unvalidated Redirects and Forwards vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing.This issue affects Aculect AI Companion: from n/a through 0.8.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mehul Gohil | Aculect AI Companion | 0 ~ 0.8.1 | - |
|
II. Public POCs for CVE-2026-39600
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39600
请登录查看更多情报信息。
Other References for CVE-2026-39600 (1)
IV. Related Vulnerabilities
Same weakness: CWE-601
-
CVE-2026-55252
OpenRun: Redirect URL validation bypass using //host paths -
CVE-2026-83589
Oauth-proxy: open redirect via /\ and /\t bypass in post-log -
CVE-2026-102090
Kiteworks Core content injection -
CVE-2026-103048
Open Redirect in Special:Book -
CVE-2026-53989
Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint
V. Comments for CVE-2026-39600
No comments yet