CVE-2026-104741: CWE-862 Missing Authorization in senols AI Puffer – AI Chatbot, AI Writer & Automation

CVE-2026-104741 is an authorization bypass vulnerability (CWE-862) in the AI Puffer WordPress plugin versions up to and including 2.4.89. The plugin fails to properly verify user authorization for certain actions, enabling authenticated users with subscriber-level privileges or above to modify global plugin indexing and vector-search configuration options. Exploitation requires that an administrator has granted 'sources' module access to a lower-privileged role via the plugin's Role Manager. The affected settings include chunking parameters, file upload visibility, and per-CPT field indexing settings, which affect all users of the plugin.

The vulnerability allows limited integrity impact by enabling unauthorized modification of global plugin configuration settings related to indexing and vector search. There is no impact on confidentiality or availability. The exploit requires authenticated access with at least subscriber-level privileges and specific Role Manager configuration by an administrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should avoid granting 'sources' module access to lower-privileged roles via the plugin's Role Manager to mitigate exploitation risk.