CVE-2026-75798: CWE-862 Missing Authorization in AI Engine

CVE-2026-75798 describes a missing authorization vulnerability (CWE-862) in the AI Engine WordPress plugin prior to version 3.7.2. The plugin fails to verify user authorization on a feature intended only for administrators, relying solely on a token distributed to anonymous users. This flaw permits unauthenticated attackers to run arbitrary AI queries against the site owner's configured AI provider account, potentially leading to unauthorized use of resources or service abuse. The vulnerability has a CVSS score of 5.3 (medium severity) with no confidentiality or availability impact, but with integrity impact limited to unauthorized query execution. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated attackers to execute AI queries through the affected plugin using the site owner's AI provider account. This could lead to unauthorized use of the AI service and potential abuse of the site owner's account or resources. There is no reported impact on confidentiality or availability, but integrity is affected due to unauthorized query execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling the vulnerable feature or restricting access to the plugin's administrative functions to trusted users only.