Data Exposure in AI Engine WordPress Plugin by AI Engine
CVE-2026-12510
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-12510?
The AI Engine WordPress plugin, prior to version 3.5.5, has a security flaw that allows users with subscriber-level access to improperly access private conversations of other users. This issue arises from the plugin's failure to confirm user ownership of a specified chatbot conversation based on a client-provided identifier. If the discussions feature is activated, an attacker could exploit this vulnerability to read other users' private conversations and hijack their conversation records, leading to serious privacy concerns.
Affected Version(s)
AI Engine 0 < 3.5.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.