Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.311.0 - Unauthenticated Missing Authorization to AI Chat and AI Search REST Endpoints and Restricted Collections
- ID
- WPSEC-2026-1235
- Plugin
- Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search (echo-knowledge-base)
- Affected
- all versions before 17.311.1
- Remediation
- Update to 17.311.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-18
- Attack surface
- Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search on WPSec AttackSurface
- Fix released
- Published
Description
The Echo Knowledge Base plugin for WordPress is vulnerable to unauthorized access via its public AI Chat and AI Search REST endpoints in all versions up to, and including, 17.311.0. This is due to missing authorization checks. The endpoints only checked that the feature was not turned 'off', so they stayed open to everyone while AI Chat or AI Search was in the administrator-only 'preview' mode. The AI Chat collection check also accepted any training data collection ID in the 'all pages' and 'all except' display modes, and in 'selected only' mode it accepted collections assigned to saved but inactive chat locations. This makes it possible for unauthenticated attackers to use AI Chat and AI Search before the administrator has made them public, and to query AI training data collections that are not assigned to any active chat location.
References
- https://wpsec.com/vuln/WPSEC-2026-1235/
- https://plugins.svn.wordpress.org/echo-knowledge-base/tags/17.311.1/
- https://wordpress.org/plugins/echo-knowledge-base/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS