AI Engine EUVD-2026-109673

Exploitation requires an existing authenticated account on the target WordPress site (PR:L), so an attacker needs at least low-privilege access such as a registered subscriber on a site that permits self-registration; the flaw is otherwise remote (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N). The affected software is the Meow Apps AI Engine plugin for WordPress at versions from n/a through 3.8.6. The specific feature, endpoint, or configuration that lacks the authorization check is not described in the available sources, so the exact action an attacker can perform is unconfirmed; the main limiting factor is the required authenticated low-privilege account, and impact is bounded to limited integrity modification (no confidentiality or availability effect).

This is a moderate-severity, low-priority issue rather than an emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity flaw that nonetheless requires PR:L - an authenticated, low-privileged account (e.g., a subscriber-level WordPress user) - and yields only limited integrity impact with no confidentiality or availability loss. The vuln.today decision label is 'this_month', not act_now/emergency, consistent with the modest CVSS and the absence of stronger exploitation signals. No EPSS score was provided, the CVE is not listed in CISA KEV, and no confirmed public exploit code is present - only a Patchstack vulnerability-database advisory reference. The signals are internally consistent (low score, authenticated access requirement, missing-authorization class, no active-exploitation evidence), so this reads as a genuine but low-urgency broken-access-control bug rather than a high-CVSS/low-real-risk mismatch. Key limitation: the advisory does not specify the exact affected endpoint or action, so the precise integrity impact is inferred from the CVSS vector rather than confirmed from a mechanism description.

A user who already holds a low-privileged authenticated account on a WordPress site running AI Engine (versions up to and including 3.8.6) sends a request to a plugin function that fails to verify the caller's authorization level, performing an action or modifying data they should not be permitted to. No user interaction is needed and the attack is remote over the network, but a valid low-level account is required. No verified working exploit code is identified; only a Patchstack advisory reference exists.