CVE-2026-6803

MediumCVSS 5.3/10Last modified Jul 15, 2026

Description

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wp_ajax_ and wp_ajax_nopriv_ hooks, as the base controller's getPermissions() returns an empty array and neither removeGroup nor clear are added to getNoncedMethods(), causing the authorization gate to unconditionally return true for these actions. This makes it possible for unauthenticated attackers to delete specific records by ID or delete all records from any module's database table by unauthenticated attackers.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jul 11, 2026
Last modified: Jul 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-68045.3The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including CVE-2026-68057.5Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the se CVE-2026-68067.5The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_l CVE-2026-680607.5A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. CVE-2026-680625.8SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log CVE-2026-680679.8The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for t CVE-2026-680689.0The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-CVE-2026-68075.5A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended CVE-2026-680708.8The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received byt CVE-2026-680737.5A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issu CVE-2026-680747.5A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This CVE-2026-680756.5An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affect