CVE-2026-6639 is a missing authorization vulnerability (CWE-862) in the AI Copilot – Content Generator WordPress plugin by wupsales, affecting all versions up to 1.4.6. The getCurrentTaskResults() method in modules/workspace/controller.php is exposed via unauthenticated AJAX endpoints (wp_ajax_nopriv_ hooks) and is not protected by nonce or permission checks. This allows unauthenticated attackers to enumerate task IDs and retrieve sensitive data stored in the database, including plaintext OpenAI API keys, AI prompts, keywords, and full AI model configurations. The base getPermissions() method returns an empty array, and the method is not included in the getNoncedMethods() array, resulting in no authorization enforcement.

An unauthenticated attacker can access sensitive configuration data such as OpenAI API keys and AI model parameters by enumerating task IDs through the exposed getCurrentTaskResults() method. This leads to sensitive information exposure with high confidentiality impact. There is no impact on integrity or availability reported. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin or disable it if possible. Monitor for updates from the vendor addressing authorization checks on the getCurrentTaskResults() method and proper AJAX action registration. Avoid exposing sensitive API keys in task parameters or database storage where possible.