What is the CVSS score of EUVD-2026-63824?

EUVD-2026-63824 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of AI Engine are affected by EUVD-2026-63824?

The AI Engine WordPress plugin (versions 2.8.0-3.6.0) contains a privilege escalation vulnerability allowing sub-site administrators in multisite deployments to gain network administrator access;…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-63824?

Yes, a public proof-of-concept exploit is available for EUVD-2026-63824. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-63824?

Within 24 hours, identify all WordPress Multisite installations using AI Engine plugin versions 2.8.0-3.6.0 and assess the number and trustworthiness of sub-site administrators with access. Within 7 days, upgrade all affected installations to AI Engine version 3.6.1 or later, prioritizing production multisite networks. Within 30 days, conduct post-patch verification across all deployments, review sub-site administrator access logs from the vulnerability window for suspicious account changes, and implement access controls limiting sub-site admin capabilities where business requirements permit.

AI Engine EUVD-2026-63824

| CVE-2026-75796 HIGH

Improper Privilege Management (CWE-269)

2026-08-21 WPScan

GHSA-r675-399r-4w8x

Privilege Escalation WordPress Ai Engine

7.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Scope is Changed (S:C) because a sub-site admin exploits across the Multisite security boundary to compromise the Network Administrator, a distinct authority scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 21, 2026 - 13:25 vuln.today

CVSS changed

Aug 21, 2026 - 13:22 NVD

7.2 (HIGH)

Patch available

Aug 21, 2026 - 07:16 EUVD

CVE Published

Aug 21, 2026 - 06:00 cve.org

HIGH 7.2

CVE Published

Aug 21, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High, 3 With POC Aug 22, 2026

AnalysisAI

Privilege escalation in the AI Engine WordPress plugin (versions 2.8.0 through 3.6.0) enables any sub-site Administrator in a WordPress Multisite network to take over arbitrary accounts-including the Network Administrator-due to missing authorization checks on user management operations. A publicly available proof-of-concept exists per WPScan, and a vendor patch has been released at version 3.6.1. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as sub-site Administrator

Delivery

Identify Network Admin account via user enumeration

Exploit

Send crafted AI Engine user management request targeting Network Admin

Execution

Plugin skips authorization check

Persist

Modify Network Admin credentials or email

Impact

Control entire Multisite network

Access

Authenticate as sub-site Administrator

Delivery

Identify Network Admin account via user enumeration

Exploit

Send crafted AI Engine user management request targeting Network Admin

Execution

Plugin skips authorization check

Persist

Modify Network Admin credentials or email

Impact

Control entire Multisite network

Vulnerability AssessmentAI

Exploitation	Exploitation requires WordPress to be configured in Multisite mode (a non-default deployment requiring explicit activation during WordPress setup or via wp-config.php); the AI Engine plugin must be installed, activated, and running a version between 2.8.0 and 3.6.0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H assigns the highest possible impact scores (C/I/A all High), reflecting the ability to fully compromise any account on the network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated sub-site Administrator-such as a client or tenant on a managed WordPress Multisite hosting platform-sends a crafted HTTP request to an AI Engine user management endpoint, specifying the Network Administrator's user ID as the target. Because the plugin does not verify the requester's authority over that account, the operation succeeds, allowing the attacker to modify the Network Administrator's credentials or email, effectively taking full control of the entire network. …
Remediation	Upgrade the AI Engine WordPress plugin to version 3.6.1 or later, which contains the vendor-released patch resolving the authorization bypass. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all WordPress Multisite installations using AI Engine plugin versions 2.8.0-3.6.0 and assess the number and trustworthiness of sub-site administrators with access. …

Threat intelligence, references, and detailed analysis are available after sign-in.