AI Engine: Missing authorization
AI Engine <= 3.8.6 has an authorization flaw that lets a low-privilege authenticated user alter protected plugin state, as indicated by the source CVSS confidentiality/integrity impacts. Attacker-controlled requests reach an operation without an adequate permission check. The export does not disclose the endpoint, parameter, affected object, exact minimum WordPress role for authenticated access, or a more specific operation; it does not establish administrator takeover.
- Component
- AI Engine
- Plugin slug
ai-engine- Affected
- <= 3.8.6
- Safe version
3.8.7- Published
- Oct 26, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Oct 26, 2026 and is one of 44 known issues for this plugin.
Update, patch or deactivate.
Update AI Engine to 3.8.7 or later. Require server-side capability and object-ownership checks before the affected operation reads or changes protected data. Do not treat a caller-supplied object key or nonce as proof of authorization. Review unauthorized access or changes to the affected plugin’s data.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N