What is the CVSS score of CVE-2026-27407?

CVE-2026-27407 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of AI Engine are affected by CVE-2026-27407?

The AI Engine WordPress plugin (versions 3.4.9 and earlier) allows site editors to escalate to administrator privileges.

How to fix or mitigate CVE-2026-27407?

24 hours: Identify all WordPress installations running AI Engine plugin through version 3.4.9. 7 days: Restrict Editor role permissions and implement user activity monitoring for privilege changes. 30 days: Monitor Meow Apps security advisories for patch release and prepare for immediate deployment once available.

AI Engine CVE-2026-27407

EUVD-2026-36916 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-06-15 Patchstack

GHSA-hwm7-rr3p-6982

Privilege Escalation Ai Engine

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Reachable over the network with no user interaction; Editor is a mid-tier authenticated role so PR:L is more accurate than PR:H; successful escalation yields full admin control (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:39 vuln.today

DescriptionCVE.org

Editor Privilege Escalation in AI Engine <= 3.4.9 versions.

AnalysisAI

Privilege escalation in the AI Engine WordPress plugin (Meow Apps) through version 3.4.9 allows authenticated users with Editor-level access to elevate their privileges to Administrator. CVSS rates this 7.2 (High) given high privileges required but full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.

Technical ContextAI

AI Engine is a popular WordPress plugin by Meow Apps that integrates OpenAI/ChatGPT-style AI features (chatbots, content generation, image creation) into WordPress sites. The root cause maps to CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns or honors privileges in a way that does not match the intended authorization model - typically a plugin endpoint or capability check that permits an Editor-role user to perform actions reserved for Administrators. The affected CPE is cpe:2.3:a:meow_apps:ai_engine for all versions up to and including 3.4.9.

RemediationAI

Upgrade the AI Engine plugin to a version greater than 3.4.9 as published by Meow Apps; the input data does not name a specific fixed release, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ai-engine/vulnerability/wordpress-ai-engine-plugin-3-4-9-privilege-escalation-vulnerability) and the plugin's WordPress.org changelog for the exact patched version before updating. If immediate patching is not possible, compensating controls include temporarily deactivating the AI Engine plugin (trade-off: AI features become unavailable to all users), tightly restricting who holds the Editor role and auditing existing Editor accounts for unexpected administrative actions, and putting the WordPress admin area (/wp-admin, /wp-json/ai-engine/*) behind an IP allowlist or WAF rule that blocks Editor sessions from invoking AI Engine administrative endpoints. Patchstack-protected sites can also enable the vendor's virtual patch as an interim mitigation. Patch available per vendor advisory; released patched version not independently confirmed from the supplied data.