{
 "id": "WPSEC-2026-1803",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1803/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1803/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1803/index.md",
 "title": "AI Engine <= 3.8.7 - Authenticated (Editor+) Sensitive Information Exposure via Log Endpoints",
 "description": "The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure via the /mwai/v1/get_logs and /mwai/v1/clear_logs REST endpoints in all versions up to, and including, 3.8.7, due to the endpoints checking can_access_features() (Editor or Administrator) instead of the settings capability (manage_options). This makes it possible for authenticated attackers, with Editor-level access and above, to read the plugin's debug log, which can contain chat messages and request details from other users, and to delete it. The log is only written when Dev Tools and server debug mode are enabled.",
 "plugin": {
  "slug": "ai-engine",
  "name": "AI Engine",
  "full_name": "AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini",
  "wordpress_org": "https://wordpress.org/plugins/ai-engine/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ai-engine/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ai-engine"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-284"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.3,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.8",
 "remediation": "Update to 3.8.8 or later.",
 "fix_released": "2026-10-27T05:40:40+00:00",
 "published": "2026-10-28T05:46:21+00:00",
 "updated": "2026-10-27T13:38:30.529475+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1803/",
  "https://plugins.svn.wordpress.org/ai-engine/tags/3.8.8/",
  "https://wordpress.org/plugins/ai-engine/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ai-engine",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}