AI Engine exposes stored provider credentials to Editors
AI Engine before 3.6.4 exposes its complete option set to users who may access plugin features, including Editors, by placing Meow_MWAI_Admin::admin_enqueue_scripts() data into localized inline options on wp-admin pages. Although the settings screen itself requires manage_options, the localized data includes third-party API keys and bearer/authentication tokens in cleartext. An Editor can read those credentials from page source and use them outside WordPress within the provider or token's privileges. The exact generated JavaScript variable name is not established by the CNA.
- Component
- AI Engine
- Plugin slug
ai-engine- Affected
- < 3.6.4
- Safe version
3.6.4- Published
- Aug 06, 2026
This CVE was published Aug 06, 2026 and is one of 35 known issues for this plugin.
Update, patch or deactivate.
Update AI Engine to 3.6.4 or later. Rotate exposed provider API keys and bearer tokens, review their external usage and limit plugin feature access to trusted users.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N