Description

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-26T06:16:27.333Z",
  "pubdate": "2026-08-26T06:16:27.333Z",
  "executiveSummary": "The AI Engine WordPress plugin before version 3.7.2 contains a critical security vulnerability involving improper authorization for administrative-level functionality.\nThe vulnerability allows unauthenticated remote attackers to execute arbitrary AI queries using the site administrator's configured API provider account.\nThis flaw stems from a reliance on client-side security tokens distributed to anonymous users, rather than enforcing server-side authorization checks for administrative endpoints.\nImpacts include unauthorized consumption of the site owner's API usage quotas, potential financial charges incurred from the third-party AI provider, and the risk of exfiltrating or manipulating data through the AI model's interface.\nThe vulnerability is exploitable over the network by any unauthenticated user, representing a significant risk to the security and financial integrity of the WordPress site's infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is an authorization bypass within the AI Engine plugin's administration feature set. The plugin fails to perform necessary server-side validation to verify that a request is initiated by an authenticated administrator. Instead, it relies on a token issued to anonymous visitors to authorize access to backend AI query functionality.\nIn the standard operational flow, a site administrator configures the plugin with their unique API credentials (e.g., OpenAI or similar providers). The vulnerability exists because the administrative endpoint responsible for handling AI queries does not check for the 'manage_options' capability or any other administrative authentication requirement. Instead, the endpoint accepts a token that is readily available to anonymous visitors, effectively treating unauthenticated requests as authorized interactions.\nThe attack flow proceeds as follows: First, an attacker identifies the endpoint used by the plugin to communicate with the configured AI provider. Second, because the plugin exposes this functionality to the client side without server-side gatekeeping, an attacker can craft a request that includes the exposed token. Third, the plugin, trusting this token, forwards the attacker's arbitrary query to the configured third-party AI provider on behalf of the site owner.\nBecause the plugin is configured with the administrator's API keys, every query processed via this exploit is billed to the administrator's account. An attacker can leverage this to perform large-scale resource exhaustion or to interact with the AI model in ways that bypass the intended design, potentially leading to unauthorized data exposure or malicious content generation. This exposure is entirely network-based and requires no prior administrative knowledge or WordPress account credentials, as the vulnerable component is accessible to the public internet.\nPost-exploitation, the attacker maintains the ability to interact with the provider as the victim until the token is rotated or the plugin is patched. The lack of server-side validation ensures that the integrity of the plugin's interaction with external AI services is completely compromised, as the attacker essentially hijacks the API connection authorized by the site owner."
}