What is the CVSS score of CVE-2026-6803?

CVE-2026-6803 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

AIWU AI Copilot CVE-2026-6803

EUVD-2026-43134 MEDIUM

Missing Authorization (CWE-862)

2026-07-11 Wordfence

GHSA-cvg5-h6q6-299w

WordPress Authentication Bypass Wordpress Plugin Ai Copilot Content Generator Wupsales

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

8.2 HIGH

Mass deletion of all records from any plugin table warrants I:H over I:L; A:L reflects loss of plugin functionality; PR:N confirmed by wp_ajax_nopriv_ hook registration.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 05:09 vuln.today

CVE Published

Jul 11, 2026 - 03:44 cve.org

MEDIUM 5.3

DescriptionCVE.org

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wp_ajax_ and wp_ajax_nopriv_ hooks, as the base controller's getPermissions() returns an empty array and neither removeGroup nor clear are added to getNoncedMethods(), causing the authorization gate to unconditionally return true for these actions. This makes it possible for unauthenticated attackers to delete specific records by ID or delete all records from any module's database table by unauthenticated attackers.

AnalysisAI

Unauthenticated mass data deletion in the AI Copilot - Content Generator WordPress plugin (all versions through 1.4.12) exposes sites to complete wipeout of plugin-managed database records by any remote visitor. The vulnerability stems from a permanently open authorization gate: the base controller's getPermissions() returns an empty array causing the auth check to unconditionally pass, while the removeGroup and clear AJAX actions are excluded from getNoncedMethods(), bypassing nonce verification entirely. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the attack requires no credentials and minimal technical skill given the straightforward AJAX endpoint targeting.

Technical ContextAI

The affected component is the base controller class of the WordPress plugin (classes/controller.php, lines 112, 133, 142 per Trac references). WordPress exposes AJAX endpoints via wp-admin/admin-ajax.php; actions registered under wp_ajax_nopriv_ are accessible to unauthenticated visitors. The plugin's authorization framework relies on getPermissions() to gate actions and getNoncedMethods() to enforce nonce (CSRF token) checks. Because getPermissions() returns an empty array, the permission resolution logic has no rules to enforce and defaults to granting access unconditionally. Additionally, removeGroup and clear are not listed in getNoncedMethods(), so nonce validation is skipped entirely. CWE-862 (Missing Authorization) is the precise root cause: authorization logic exists in the framework but is rendered inert by misconfiguration of the permission and nonce method registries. The affected CPE is cpe:2.3:a:wupsales:ai_copilot_-_content_generator:*:*:*:*:*:*:*:*, covering the wupsales vendor's plugin up to version 1.4.12.

RemediationAI

A fix commit is referenced via the WordPress Plugin SVN changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3582369%40ai-copilot-content-generator&new=3582369%40ai-copilot-content-generator), though the exact patched release version number is not independently confirmed from the provided data - upstream fix available (commit/changeset); released patched version not independently confirmed. Administrators should update the AI Copilot - Content Generator plugin to the latest available version immediately via the WordPress dashboard (Plugins > Installed Plugins > Check for Updates). As a compensating control prior to patching, a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php that include action parameters matching the plugin's removeGroup or clear actions will prevent exploitation, though this may break legitimate unauthenticated plugin AJAX functionality. Alternatively, temporarily deactivating the plugin eliminates all attack surface at the cost of losing chatbot and workflow features. Consult the Wordfence advisory for any updated patch version confirmation.