CVE-2026-6803 is a missing authorization vulnerability (CWE-862) affecting the AI Copilot – Content Generator plugin for WordPress by wupsales. The issue exists in all versions up to and including 1.4.12 due to the absence of capability checks and nonce verification on AJAX actions registered under both wp_ajax_ and wp_ajax_nopriv_ hooks. The base controller's getPermissions() method returns an empty array, and methods removeGroup and clear are not included in getNoncedMethods(), resulting in an unconditional authorization grant. This flaw allows unauthenticated attackers to delete specific records by ID or all records from any module's database table via these AJAX actions.

An unauthenticated attacker can delete data records from the plugin's database tables, either selectively by ID or all records from any module. This leads to integrity loss of stored data within the affected WordPress plugin, potentially disrupting functionality or causing data loss. There is no confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin's AJAX endpoints if possible, and monitor for suspicious deletion activity. Avoid using affected versions in production environments where data integrity is critical.