CVE-2026-2993 is an SQL Injection vulnerability (CWE-89) in the AI Chatbot & Workflow Automation by AIWU WordPress plugin, affecting versions up to and including 1.4.17. The issue is due to insufficient escaping and lack of prepared statements in the getListForTbl() function, enabling unauthenticated attackers to inject additional SQL queries. A partial mitigation involving a nonce check for administrators was introduced in version 1.4.11, but this does not fully resolve the vulnerability for all users. No official patch or remediation level is documented, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to extract sensitive information from the plugin's database by injecting SQL commands. The vulnerability does not affect data integrity or availability but compromises confidentiality. The partial mitigation limits some attack vectors to administrator contexts but does not fully prevent exploitation by unauthenticated users in affected versions.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. A partial mitigation exists since version 1.4.11 that adds a nonce check for administrators, but this does not fully address the vulnerability in versions up to 1.4.17. Users should monitor for an official fix from the vendor and apply it once available. Until then, restricting access and minimizing exposure of the vulnerable plugin may reduce risk.