CVE-2026-75796: CWE-269 Improper Privilege Management in AI Engine

The AI Engine WordPress plugin before version 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations. This improper privilege management (CWE-269) allows users with Administrator privileges on a Multisite sub-site to escalate their privileges and take over any account on the network, including the Network Administrator's account. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with Administrator privileges on a Multisite sub-site can exploit this vulnerability to take over any user account on the WordPress network, including the highest privileged Network Administrator account. This results in full compromise of the network, allowing complete control over all sites and user data.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict Administrator privileges on Multisite sub-sites to trusted users only to reduce risk.