{
 "id": "WPSEC-2026-1207",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1207/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1207/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1207/index.md",
 "title": "AI Engine <= 3.8.5 - Authenticated (Editor+) Insecure Direct Object Reference to Arbitrary Post Title and Excerpt Modification",
 "description": "The AI Engine plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'postId' parameter of the /mwai/v1/helpers/update_post_title and /mwai/v1/helpers/update_post_excerpt REST routes in all versions up to, and including, 3.8.5, due to the routes only checking that the user is an Editor or Administrator and never checking whether the user may edit the specific post. This makes it possible for authenticated attackers with Editor-level access and above to change the title or excerpt of posts they are not permitted to edit, such as WooCommerce coupons, products or orders, navigation menus and templates.",
 "plugin": {
  "slug": "ai-engine",
  "name": "AI Engine",
  "full_name": "AI Engine – The Chatbot, AI Framework & MCP for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/ai-engine/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ai-engine/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ai-engine"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.6",
 "remediation": "Update to 3.8.6 or later.",
 "fix_released": "2026-10-17T02:24:11+00:00",
 "published": "2026-10-18T02:40:36+00:00",
 "updated": "2026-10-17T08:19:32.815576+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1207/",
  "https://plugins.svn.wordpress.org/ai-engine/tags/3.8.6/",
  "https://wordpress.org/plugins/ai-engine/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ai-engine",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-17"
 }
}