CVE-2026-12510

Published: Jul 16, 2026Modified: Jul 16, 2026Deferred

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Exploitability: 1.6 / Impact: 4.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (1)

https://wpscan.com/vulnerability/b7825c8a-1817-4a17-b641-076e48ac7c2e/

Source: contact@wpscan.com

Timeline

No history available yet.