AI Engine CVE-2026-110888

Requires a valid authenticated WordPress account with at least low privileges on a site running the AI Engine (ai-engine) plugin version n/a through 3.8.3 (PR:L). Exploitation targets an AI Engine feature/endpoint whose access-control level is incorrectly configured, allowing a lower-privileged user to reach functionality that should be restricted; the specific endpoint and privileged action are not named in the description. Limiting factors: an authenticated session is mandatory (unauthenticated visitors cannot exploit it), impact is confined to limited integrity (C:N/A:N, I:L), and only installations running the plugin at or below 3.8.3 are affected.

This is a genuine but modest-priority issue. The CVSS 3.1 base score of 4.3 (Medium) is grounded in the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N: remotely reachable over the network with low attack complexity and no user interaction, but requiring an already-authenticated low-privilege account (PR:L) and yielding only limited integrity impact (I:L) with no confidentiality or availability loss. The CWE-862 (Missing Authorization) classification is consistent with the 'Incorrectly Configured Access Control Security Levels' description - a lower-privilege user can invoke functionality meant to be restricted. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The signals are internally consistent (no CVSS-versus-description conflict), but the key missing data (EPSS probability and POC status) means widespread automated exploitation cannot be assessed and should not be assumed. Net: a real but low-to-medium severity broken-access-control flaw whose main limiting factor is the prerequisite authenticated account, not a top-priority critical.

An attacker who holds a low-privilege authenticated account on the WordPress site (e.g., a subscriber or other low-tier role) sends a crafted request to an AI Engine endpoint whose authorization check is missing or misconfigured, performing an action or modifying data that should require higher privileges. No user interaction is needed and attack complexity is low, but a valid low-privilege login is required. No public proof-of-concept was identified in the provided intelligence.