CVE-2026-110982

MediumCVSS 4.9/10Last modified Oct 21, 2026

Description

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	AI Engine	< 3.8.6

References

https://wpscan.com/vulnerability/59f18552-e60e-466f-949d-cc09aa657bbe/

Timeline

Published: Oct 21, 2026
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1109834.3The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management CVE-2026-1109859.1A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its impl CVE-2026-1109926.5A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository p CVE-2026-11107.8A flaw has been found in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. This affects the function rtsp_parse_method. This ma CVE-2026-111009.6Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spec CVE-2026-1110007.1A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain CVE-2026-111016.5Uninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craft CVE-2026-111028.8Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary cod CVE-2026-1110217.1The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting CVE-2026-1110247.1A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a View CVE-2026-1110276.8The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and CVE-2026-111037.8Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level pr