{"id":"CVE-2026-110982","kind":"vulnerability","aliases":["CVE-2026-110982"],"related":[],"title":"AI Engine WordPress plugin lets editors change posts they cannot edit","description":"The AI Engine  WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.","summary":"The AI Engine WordPress plugin before 3.8.6 skips the permission check before updating a post's title and excerpt. A user with the Editor role can therefore change any post type, including navigation menus, block templates, global styles and WooCommerce coupons.","severity":"medium","cvss":4.9,"epss":0.00207,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-engine","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-editor-accounts","plugin-3.8.6-or-later","plugin-not-installed"],"how_to_check":"- Check the installed AI Engine plugin version in the WordPress admin Plugins page or with `wp plugin get ai-engine --field=version`\n- Confirm whether untrusted users hold the Editor role on the site","fix":"- Update the AI Engine plugin to `3.8.6` or later\n- Review Editor accounts and remove any that are not needed","status":"open","published_at":"2026-10-21T06:16:48+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:31:08+00:00","updated_at":"2026-10-25T04:31:08+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:31:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update the AI Engine plugin to `3.8.6` or later\n- Review Editor accounts and remove any that are not needed","reach":"internet","title":"AI Engine WordPress plugin lets editors change posts they cannot edit","impact":"medium","summary":"The AI Engine WordPress plugin before 3.8.6 skips the permission check before updating a post's title and excerpt. A user with the Editor role can therefore change any post type, including navigation menus, block templates, global styles and WooCommerce coupons.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","ai-engine","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Editor changes titles and excerpts of menus, templates, coupons","analyst_note":"","how_to_check":"- Check the installed AI Engine plugin version in the WordPress admin Plugins page or with `wp plugin get ai-engine --field=version`\n- Confirm whether untrusted users hold the Editor role on the site","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-3.8.6-or-later","no-editor-accounts"],"who_is_affected":"Sites running the AI Engine WordPress plugin older than 3.8.6 that have users with the Editor role or higher. Sites that do not run the plugin, or that only have Administrators and Authors, are less exposed. The attacker needs a logged-in Editor account.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00061,"input_tokens":3377,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110982':14A,17A '-2026':13A,16A '3.8.6':35B,76C 'ai':1A,19B,30B,71C 'ai-engin':18B 'allow':84C,96C 'arbitrari':106C 'block':63B,121C 'caller':82C 'cannot':10A,114C 'chang':7A,56B 'check':39B,79C 'content':112C 'coupon':69B,127C 'cve':12A,15A 'edit':11A,86C,116C 'editor':6A,52B,100C 'engin':2A,20B,31B,72C 'excerpt':47B,95C 'global':65B,123C 'host':24B 'includ':60B,111C 'let':5A 'menus':62B,120C 'modifi':105C 'navig':61B,119C 'object':89C 'otherwis':115C 'packag':21B 'permiss':38B 'plugin':4A,28B,33B,74C 'post':8A,43B,58B,107C 'role':53B,101C 'self':23B 'self-host':22B 'skip':36B 'style':66B,124C 'target':88C 'templat':64B,122C 'therefor':55B 'titl':45B,93C 'type':59B,110C 'updat':41B,91C 'user':49B,97C 'woocommerc':68B,126C 'wordpress':3A,25B,27B,32B,73C 'wordpress-plugin':26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the AI Engine WordPress plugin older than 3.8.6 that have users with the Editor role or higher. Sites that do not run the plugin, or that only have Administrators and Authors, are less exposed. The attacker needs a logged-in Editor account.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110982","severity":null,"published_at":"2026-10-21T06:16:48+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110982","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110982","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}