CVE-2026-6639 is a missing authorization vulnerability (CWE-862) in the AI Copilot – Content Generator WordPress plugin by wupsales. The getCurrentTaskResults() method in modules/workspace/controller.php is exposed via AJAX actions registered with wp_ajax_nopriv_ hooks, lacking authentication and authorization checks. This allows unauthenticated attackers to enumerate sequential task IDs and retrieve sensitive information stored in the database, such as OpenAI API keys in plaintext, AI prompts, keywords, and full AI model configurations. The base getPermissions() method returns an empty array, and the vulnerable method is not protected by nonces, exacerbating the exposure risk. The vulnerability affects all versions up to and including 1.4.6. No patch or official fix has been disclosed as of the publication date.

An unauthenticated attacker can access sensitive configuration data including OpenAI API keys, AI prompts, keywords, and model configurations by enumerating task IDs. This exposure can lead to unauthorized use of API keys and compromise of AI model parameters, potentially resulting in data leakage and misuse of AI services. The vulnerability does not impact integrity or availability but has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin or disable it if possible. Monitor for updates from the vendor regarding patches or mitigations. Avoid exposing the plugin to untrusted users or public access.