CVE-2026-111041: CWE-862 Missing Authorization in AI Engine
Description
The AI Engine WordPress plugin before version 3.7.9 contains a missing authorization vulnerability. This flaw allows users with the Editor role or higher to perform AI media management actions on posts they do not own or have permission to edit. Specifically, these users can modify or change the type of arbitrary posts on the site without proper authorization checks.
Affected software
AI Engine
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111041 is a missing authorization vulnerability (CWE-862) in the AI Engine WordPress plugin versions prior to 3.7.9. The plugin fails to verify that a user performing certain AI media management actions is authorized to edit the targeted post object. As a result, users with the Editor role or above can modify or change the type of arbitrary posts, including those they are not permitted to edit under normal permissions.
Potential Impact
Users with the Editor role or higher can exploit this vulnerability to modify or change the type of posts they do not own or have explicit permission to edit. This could lead to unauthorized content changes on the affected WordPress site, potentially impacting content integrity and site management.
Mitigation Recommendations
Upgrade the AI Engine WordPress plugin to version 3.7.9 or later, where this authorization issue has been fixed. Since no official patch link is provided, users should verify the availability of the fixed version from the plugin vendor or WordPress plugin repository. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-15T12:35:49.233Z
- State
- PUBLISHED
Threat ID: 6ad468502cdf04f656428a1b
Added to database: 10/18/2026, 06:33:52 UTC
Last enriched: 10/18/2026, 06:53:01 UTC
Last updated: 10/18/2026, 06:53:01 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.