What is the CVSS score of EUVD-2026-43144?

EUVD-2026-43144 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

AI Copilot WordPress Plugin EUVD-2026-43144

| CVE-2026-6804 MEDIUM

Missing Authorization (CWE-862)

2026-07-11 Wordfence

GHSA-62q4-whmm-v2fm

WordPress Authentication Bypass Wordpress Plugin Ai Copilot Content Generator Wupsales

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

7.3 HIGH

Draft post exposure constitutes C:L and forced unpublishing causes A:L; PR:N confirmed by both CVSS vector and description's explicit 'unauthenticated attackers' language.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 05:21 vuln.today

CVE Published

Jul 11, 2026 - 03:44 cve.org

MEDIUM 5.3

DescriptionCVE.org

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to publish draft WordPress posts, exposing unpublished content, or unpublish live content, causing service disruption, by supplying arbitrary scenario IDs.

AnalysisAI

Authorization bypass in the AI Copilot - Content Generator WordPress plugin (by wupsales/AIWU) allows unauthenticated remote attackers to manipulate WordPress post publication states across all versions through 1.4.12. By supplying arbitrary scenario IDs to the plugin's workspace controller endpoint - which lacks any authorization verification - attackers can expose unpublished draft content or take live published posts offline, causing content disclosure and service disruption. No public exploit or CISA KEV listing has been identified at time of analysis, though the trivial exploitation complexity (AV:N/AC:L/PR:N/UI:N) makes independent rediscovery straightforward.

Technical ContextAI

This vulnerability resides in a WordPress plugin identified by CPE cpe:2.3:a:wupsales:ai_copilot_-_content_generator:*:*:*:*:*:*:*:* - an AI-powered chatbot and workflow automation plugin marketed under the AIWU brand. The root cause is CWE-862 (Missing Authorization): the plugin's workspace controller (modules/workspace/controller.php, lines 9, 130, 141) and its frame handler (classes/frame.php, line 283) process scenario IDs submitted via HTTP requests without verifying whether the requesting user holds any WordPress capability to alter post states. WordPress's native capability system (e.g., publish_posts, edit_published_posts) is bypassed entirely. The scenario ID mechanism - intended to automate content workflows - becomes an open, unauthenticated content state toggle.

RemediationAI

An upstream fix has been committed to the plugin's WordPress.org repository (changeset: https://plugins.trac.wordpress.org/changeset?reponame=&old=3582369%40ai-copilot-content-generator&new=3582369%40ai-copilot-content-generator); however, an exact tagged patched release version is not independently confirmed from available data - update to any version above 1.4.12 once available in the WordPress plugin repository and verify the version in your dashboard. If an immediate update is not possible, deactivate the plugin entirely to eliminate the attack surface - this is the most effective compensating control since the vulnerable endpoints are only reachable when the plugin is active. As a secondary control, deploy a WAF with WordPress-aware rules (e.g., Wordfence Firewall) to block unauthenticated requests matching the workspace controller's endpoint pattern, though this is not a substitute for patching. Restricting wp-admin and plugin REST endpoints via network-level controls to known IPs can further reduce exposure for internal-only workflows.