CVE-2026-104742: CWE-862 Missing Authorization in senols AI Puffer – AI Chatbot, AI Writer & Automation

CVE-2026-104742 is an authorization bypass vulnerability (CWE-862) in the AI Puffer – AI Chatbot, AI Writer & Automation WordPress plugin affecting all versions up to and including 2.4.89. The plugin fails to properly verify user authorization before allowing modification of global site-wide semantic search settings stored in aipkit_options. Exploitation requires an authenticated user with subscriber-level privileges or higher and that the administrator has previously granted the Knowledge Base ('sources') module access to the attacker's role via the Role Manager. This vulnerability allows unauthorized modification of settings such as vector provider, embedding provider, embedding model, target ID, number of results, and no-results text, which are normally restricted to administrators.

The vulnerability allows low-privileged authenticated users with specific role permissions to modify global semantic search configuration settings that should be restricted to administrators. This could lead to unauthorized changes in the behavior of the semantic search features of the site, potentially impacting site functionality or data integrity. There is no impact on confidentiality or availability, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should carefully manage role permissions, ensuring that the Knowledge Base ('sources') module is not granted to roles that should not have access. Restrict subscriber-level and other low-privileged users from having this module assigned to prevent exploitation.