Live › vulnerability › CVE-2026-65566
AI Engine, a WordPress plugin by Meow Apps, has a cross-site request forgery flaw affecting versions through 3.8.8. A logged-in site administrator who opens a malicious page could be tricked into making changes to the site without knowing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
WordPress sites running the AI Engine plugin (Meow Apps, about 90,000 installs) at 3.8.8 or earlier. Exploitation needs a logged-in privileged user, usually an administrator, to visit an attacker's page, so sites where admins browse the web while logged in are most at risk. Sites without the plugin can skip it. The specific forged action is not published.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ai-engine | wordpress | <= 3.8.8 | – |
wp plugin get ai-engine --field=version, or see Plugins in wp-admin.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-65566")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.