Arbitrary Object Modification in AI Engine Plugin for WordPress
CVE-2026-110982
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-110982?
The AI Engine plugin for WordPress, prior to version 3.8.6, contains a vulnerability that fails to validate the permissions of the user before permitting changes to the title and excerpt of various objects. This oversight allows users with an Editor role or higher to alter content that they typically do not have authorization to edit, including navigation menus, block templates, global styles, and WooCommerce coupons, posing significant risks to content integrity and security.
Affected Version(s)
AI Engine 0 < 3.8.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.