AI Engine EUVD-2026-90465

Exploitation requires that the AI Engine Advisor task and its PHP-error-log parsing/ingestion feature (MeowKit_MWAI_Helpers::php_error_logs → Meow_MWAI_Modules_Advisor::run_advisor) be enabled, and that the request path go through the non-streaming, non-admin catch branch that writes the raw exception to the PHP error log. The initial injection to /mwai-ui/v1/chats/submit is unauthenticated (PR:N) and needs no user interaction, but the stored payload only EXECUTES when an authenticated administrator subsequently opens the WordPress dashboard and the Advisor widget (advisor_metabox) is rendered - that admin dashboard view is the real limiting factor. Affected: AI Engine for WordPress versions up to and including 3.8.0; fixed in 3.8.1.

This is a legitimately interesting but conditionally-gated vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) treats the initial injection vector as fully unauthenticated and automatable, which is accurate for the ENTRY point (the /mwai-ui/v1/chats/submit REST endpoint is unauthenticated), but the vendor vector arguably understates user interaction - the stored script only EXECUTES when an administrator opens the WordPress dashboard and views the Advisor widget, so a UI:R-flavored precondition realistically applies and my independent lean is closer to 6.1. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Against that, the product is a very widely installed WordPress AI/chatbot plugin and the bug chain is elegant and fully documented down to source line numbers in the vendor advisory and trac, which lowers the research barrier for a weaponized exploit. Net: a real medium-to-high priority for sites running AI Engine ≤3.8.0 with the Advisor feature active, but not a drop-everything emergency absent evidence of active exploitation. Key caveat: the entire chain depends on the plugin's Advisor task and PHP-error-log parsing being enabled and on an admin subsequently viewing the dashboard - verify those preconditions before rating site-specific risk.

An unauthenticated attacker sends a crafted POST to /mwai-ui/v1/chats/submit using the key 'model_' (which convert_keys() canonicalizes back to the denylisted 'model') carrying a CR/LF-laced script payload; the resulting exception message is written verbatim to the PHP error log, re-parsed by the plugin, fed into the Advisor AI prompt, and stored unsanitized in the mwai_advisor_data option. When a site administrator later opens the WordPress dashboard, the Advisor widget renders the unescaped 'title'/'description' and the injected JavaScript executes in the admin's authenticated session. No public POC is identified, but the Wordfence advisory documents the full chain and exact source lines.