CVE-2026-75798: AI Engine Unauthenticated Arbitrary AI Query Execution

Vulnerability Overview Vulnerability Name: AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant Description: This plugin lacks authorization checks for its administrative functions, relying instead on a token that allows unauthenticated attackers to execute arbitrary AI queries under the configuration provider account of the site owner. CVE ID: CVE-2026-75798 Classification: - Type: NO AUTHORISATION - OWASP Top 10: A5: Broken Access Control - CWE: CWE-862 - CVSS: 5.3 (medium) Affected Range Affected Plugin: AI Engine (versions 3.4.0 - 3.7.1) Remediation Fixed Version: 3.7.2 Additional Information Original Researcher: Abdullah Kareem Submitter: Abdullah Kareem Submitter Website: https://cyberkareem.com Submitter Twitter: cyberkareem Verification Status: Yes WPVDB ID: a77168df-61b8-40df-95f5-e19cf6540ce5 Timeline Public Disclosure Date: 2026-08-24 Added Date: 2026-08-24 Last Updated: 2026-08-24 Other Related Vulnerabilities Easy Social Share Buttons < 9.5 - Missing Authorization Criptopayer for Elementor <= 1.0.1 - Missing Authorization WooCommerce Box Office < 11.52 - Unauthenticated Ticket Barcode Update ElementsKit Elementor Addons < 3.9.0 - Unauthenticated Missing Authorization to Widget Content Overwrite Responsive < 5.0.3 - Missing Authorization to HTML Injection POC Code POC Code: No specific POC code is provided in the page; however, it mentions that the POC will be demonstrated on 2026-09-23 to give users sufficient time to update.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-75798: AI Engine Unauthenticated Arbitrary AI Query Execution

More from this source