# Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 17.311.0 - Unauthenticated Missing Authorization to AI Chat and AI Search REST Endpoints and Restricted Collections

- **ID:** WPSEC-2026-1235
- **Plugin:** Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search (`echo-knowledge-base`), https://wordpress.org/plugins/echo-knowledge-base/
- **Affected versions:** all versions before 17.311.1
- **Fixed in:** 17.311.1 (Update to 17.311.1 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-18)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/echo-knowledge-base
- **Fix released:** 2026-10-17
- **Published:** 2026-10-18
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1235/

## Description

The Echo Knowledge Base plugin for WordPress is vulnerable to unauthorized access via its public AI Chat and AI Search REST endpoints in all versions up to, and including, 17.311.0. This is due to missing authorization checks. The endpoints only checked that the feature was not turned 'off', so they stayed open to everyone while AI Chat or AI Search was in the administrator-only 'preview' mode. The AI Chat collection check also accepted any training data collection ID in the 'all pages' and 'all except' display modes, and in 'selected only' mode it accepted collections assigned to saved but inactive chat locations. This makes it possible for unauthenticated attackers to use AI Chat and AI Search before the administrator has made them public, and to query AI training data collections that are not assigned to any active chat location.

## References

- https://wpsec.com/vuln/WPSEC-2026-1235/
- https://plugins.svn.wordpress.org/echo-knowledge-base/tags/17.311.1/
- https://wordpress.org/plugins/echo-knowledge-base/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1235/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.