The defect in Meow Apps AI Engine arises from an incorrectly configured access control mechanism that permits users to invoke plugin functionality without proper authorization. The weakness allows a user to perform actions that should be restricted, effectively elevating their privileges within the plugin’s scope. This is a classic example of Missing Authorization (CWE-862).

Sites running the WordPress AI Engine plugin version 3.8.3 or earlier, including all earlier releases for which the vendor did not publish a fix, are vulnerable. The plugin is distributed by Meow Apps under the WordPress ecosystem. Any WordPress installation that has installed the AI Engine plugin prior to version 3.8.4 is at risk.

The CVSS score of 4.3 describes a moderate impact, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Inferred from the description, the attack vector would require either local access to the WordPress site or the ability to trick a legitimate user into triggering the unprotected plugin endpoints. An attacker could use the exposed functionality to gain higher privileges or manipulate the AI Engine’s behavior, potentially affecting confidentiality or integrity of site data. Given the limited vector and low exploitation probability, the risk is moderate, but the ability to bypass authorization should not be ignored.