CVE-2026-110982: medium-severity vulnerability in AI Engine
AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.9epss 0.3%
exploitation probability
0.3%top 81% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · AI Enginepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/59f18552-e60e-466f-949d-cc09aa657bbe/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — AI Engine
In the same product, most dangerous first.
CVE-2024-6451HIGHAI Engine < 2.5.1 - Admin+ RCEEPSS 0.8%CVE-2024-10499HIGHAI-Engine < 2.6.5 - Admin+ SQLiEPSS 0.6%CVE-2026-12511HIGHAI Engine < 3.5.5 - Editor+ Arbitrary File Write via Path TraversalEPSS 0.5%CVE-2026-75796HIGHAI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User ToolsEPSS 0.5%CVE-2024-6723MEDIUMAI Engine < 2.4.8 - Admin+ SQLiEPSS 0.4%CVE-2026-75797HIGHAI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' ParameterEPSS 0.4%