CVE-2026-6804 is an authorization bypass vulnerability in the AI Copilot – Content Generator WordPress plugin by wupsales. The plugin fails to properly verify user authorization before allowing certain actions, enabling unauthenticated attackers to manipulate post statuses—specifically publishing drafts or unpublishing live posts—via arbitrary scenario IDs. This affects all plugin versions up to and including 1.4.12. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor.

Exploitation of this vulnerability can lead to unauthorized publishing of draft WordPress posts, exposing content not intended for public view, or unpublishing of live posts, causing disruption of content availability on affected sites. There is no direct confidentiality or availability impact reported beyond content exposure and service disruption related to post status manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality and monitor for unauthorized changes to post statuses. Avoid exposing the plugin's scenario ID parameters to unauthenticated users where possible.