Ai Engine Pro EUVD-2026-20172

Exploitation requires an authenticated WordPress user account (minimum Author or Editor role) on a site with AI Engine (Pro) installed and activated. The attacker must have valid login credentials to trigger the vulnerability, as unauthenticated access is not possible (CVSS PR:L indicates authentication required). The vulnerability manifests only when the user attempts to perform actions that should be restricted by the plugin's access control layer, such as modifying content authored by higher-privilege users or accessing plugin configuration features.

Multiple signals indicate this is a lower-priority vulnerability despite the authentication bypass classification. The CVSS score of 4.3 reflects moderate severity, but the EPSS score of 0.02% (4th percentile) suggests minimal exploitation likelihood in practice. The attack vector is network-accessible (AV:N) with low complexity (AC:L), but requires legitimate authenticated access (PR:L), significantly reducing the threat population. The impact is limited to integrity (I:L) with no confidentiality or availability impact (C:N/A:N), meaning attackers can modify content but cannot steal data or cause service disruption. No CISA KEV designation or public exploit code is indicated. This appears to be a privilege escalation issue relevant primarily to managed WordPress environments where user account compromise or malicious trusted users are concerns, rather than a widespread critical exposure.

An authenticated WordPress Editor or Contributor with limited permissions logs into a multi-author site running AI Engine (Pro) prior to version 3.4.2. The attacker discovers they can modify or publish AI-generated content assigned to other users, or access administrative plugin settings normally restricted to administrators, by exploiting the broken access control checks. This allows privilege escalation within the plugin's feature set without requiring WordPress administrator credentials.