CVE-2026-6803 is a Missing Authorization vulnerability in the AI Copilot – Content Generator plugin for WordPress (versions <=1.4.12). The issue is due to the base controller's getPermissions() method returning an empty array and the absence of critical methods (removeGroup and clear) in the getNoncedMethods() list. Consequently, AJAX actions registered under wp_ajax_ and wp_ajax_nopriv_ hooks lack proper capability checks and nonce verification, causing the authorization gate to always return true. This allows unauthenticated attackers to delete records by ID or purge all records from any module's database table.

An unauthenticated attacker can delete specific records or all records from any module's database table within the affected plugin. This results in integrity loss of data but does not impact confidentiality or availability directly. The vulnerability could disrupt normal operations by removing critical data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin's AJAX endpoints where possible and monitor for suspicious deletion activity. Avoid using versions up to and including 1.4.12 in production environments.