{"id":"CVE-2026-112828","kind":"vulnerability","aliases":["CVE-2026-112828"],"related":[],"title":"AI Engine WordPress plugin: missing authorization check through version 3.8.6","description":"Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.","summary":"AI Engine is a WordPress plugin by Meow Apps that adds AI features to a site. A missing authorization check lets a user reach functionality they should not be allowed to use, according to the advisory.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-engine","ai-tooling","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed AI Engine plugin version in the WordPress admin under Plugins, or with `wp plugin get ai-engine --field=version`\n- Confirm whether the installed version is `3.8.6` or earlier","fix":"- Update AI Engine to a version later than `3.8.6`; the advisory does not name the fixed release, so check the plugin changelog\n- unknown","status":"open","published_at":"2026-10-26T09:16:34+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","triaged_at":"2026-10-26T09:31:03+00:00","updated_at":"2026-10-26T09:31:03+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-26T09:31:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update AI Engine to a version later than `3.8.6`; the advisory does not name the fixed release, so check the plugin changelog\n- unknown","reach":"unknown","title":"AI Engine WordPress plugin: missing authorization check through version 3.8.6","impact":"medium","summary":"AI Engine is a WordPress plugin by Meow Apps that adds AI features to a site. A missing authorization check lets a user reach functionality they should not be allowed to use, according to the advisory.","category":"ai-tooling","nicknames":[],"who_cares":["wordpress","ai-engine","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users may reach restricted plugin actions","analyst_note":"Check the NVD entry and the Wallfence or Patchstack advisory for the affected endpoint, required role and fixed version.","how_to_check":"- Check the installed AI Engine plugin version in the WordPress admin under Plugins, or with `wp plugin get ai-engine --field=version`\n- Confirm whether the installed version is `3.8.6` or earlier","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the AI Engine WordPress plugin at version 3.8.6 or earlier are affected. The description does not say which endpoints or roles are involved, so whether a logged-out visitor or only a low-privilege user can reach the flaw is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3306,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112828':13A,16A '-2026':12A,15A '3.8.6':10A,89C 'access':78C 'accord':59B 'add':37B 'advisori':62B 'affect':83C 'ai':1A,18B,21B,27B,38B,69C,72C,84C 'ai-engin':17B,71C 'ai-tool':20B 'allow':56B,74C 'app':35B,68C 'author':6A,45B,64C 'check':7A,46B 'configur':77C 'control':79C 'cve':11A,14A 'engin':2A,19B,28B,70C,73C,85C 'exploit':75C 'featur':39B 'function':51B 'host':25B 'incorrect':76C 'issu':82C 'let':47B 'levels.this':81C 'meow':34B,67C 'miss':5A,44B,63C 'n/a':87C 'plugin':4A,32B 'reach':50B 'secur':80C 'self':24B 'self-host':23B 'site':42B 'tool':22B 'use':58B 'user':49B 'version':9A 'vulner':65C 'wordpress':3A,26B,31B","nicknames":[],"mitigations":[],"who_affected":"Sites running the AI Engine WordPress plugin at version 3.8.6 or earlier are affected. The description does not say which endpoints or roles are involved, so whether a logged-out visitor or only a low-privilege user can reach the flaw is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112828","severity":null,"published_at":"2026-10-26T09:16:34+00:00","modified_at":"2026-10-26T09:16:34+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","fetched_at":"2026-10-26T09:29:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}