AI Engine CVE-2026-12510

Requires an authenticated WordPress account at subscriber level or higher - unauthenticated exploitation is not possible per the CVSS PR:L vector. The discussions feature must be explicitly enabled within the AI Engine plugin configuration; installations with discussions disabled are not affected. The attacker must enumerate or predict valid conversation identifiers belonging to other users, contributing to the AC:H rating. The limiting factors are: (1) a valid WordPress account is required, making this inaccessible on sites with closed user registration or no subscriber accounts; (2) the discussions feature must be active; (3) identifier enumeration adds complexity. Sites with open registration, active AI chatbot usage, and sensitive conversation content face the highest realistic risk.

The CVSS 3.1 score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network exploitability with meaningful constraints: PR:L confirms at minimum a subscriber-level WordPress account is required, and AC:H indicates non-trivial complexity, most likely identifier enumeration. The C:H impact signals full exposure of any targeted conversation's contents. EPSS at 0.13% (3rd percentile) is strikingly low given that public exploit code exists via WPScan - this divergence suggests that exploitation, while technically demonstrated, has not been adopted at scale, consistent with the prerequisites of needing a registered account and the discussions feature enabled. The vulnerability is not in CISA KEV, confirming no confirmed mass exploitation. Real-world priority is moderate: high on sites with open user registration, discussions enabled, and sensitive AI conversation data; low on sites with closed registration or discussions disabled. The AC:H rating and non-zero PR requirements meaningfully narrow the exposed population compared to the raw CVSS score might suggest.

An attacker registers or uses an existing subscriber-level WordPress account on the target site, then sends API requests referencing conversation identifiers that belong to other users - cycling through IDs to locate valid records. Because the plugin performs no ownership verification, the attacker successfully retrieves private AI chatbot conversations from other users and can overwrite those records. Public exploit code documented by WPScan lowers the technical bar for this scenario.