Live › vulnerability › CVE-2026-110982
Go to dashboardThe AI Engine WordPress plugin before 3.8.6 skips the permission check before updating a post's title and excerpt. A user with the Editor role can therefore change any post type, including navigation menus, block templates, global styles and WooCommerce coupons.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the AI Engine WordPress plugin older than 3.8.6 that have users with the Editor role or higher. Sites that do not run the plugin, or that only have Administrators and Authors, are less exposed. The attacker needs a logged-in Editor account.
No product ranges from the sources yet.
wp plugin get ai-engine --field=version3.8.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.
This page as .md · .json · in your agent: get_signal("CVE-2026-110982")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.