Vulnerability in AI Engine WordPress Plugin Exposes Sensitive Configuration Data
CVE-2026-16954
Key Information:
Badges
What is CVE-2026-16954?
The AI Engine WordPress plugin prior to version 3.6.4 contains a vulnerability that allows users with the Editor role to access sensitive configuration values, including third-party API keys and authentication tokens. These secrets, typically accessible only by administrators, are exposed in cleartext within the admin page's inline script data. This flaw significantly increases the risk of unauthorized access and data breaches, making it essential for site administrators to update to the latest version to safeguard confidential information.
Affected Version(s)
AI Engine 0 < 3.6.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.