The AI Engine WordPress plugin before version 3.8.6 fails to confirm that the user requesting a title or excerpt change has permission to edit the targeted post, enabling any user with Editor or higher privileges to modify the title or excerpt of any post type, including navigation menus, block templates, global styles, and WooCommerce coupons. This improper authorization flaw allows content tampering that can alter site navigation, page layouts, and e-commerce discount mechanisms without authorization, potentially causing confusion, brand damage, or revenue loss.

WordPress sites running AI Engine plugin versions earlier than 3.8.6 are affected. The vendor is listed simply as Unknown:AI Engine, indicating that the exposure exists across all releases before the stated version.

The vulnerability is exploitable by any authenticated Editor or administrator. The attack path involves submitting a request to the plugin’s update_post_title or update_post_excerpt API endpoints without any further authorization checks, so the exploit is straightforward to execute once an account with sufficient role exists. The CVSS score is 4.9, indicating low severity, but the impact on integrity and possible disruption of site functionality is significant. The EPSS score is < 1%, indicating a very low probability of exploitation, and the flaw is not present in CISA KEV. The widespread presence of Editor roles on WordPress installations raises the likelihood of exploitation to moderate to high for compromised or hijacked accounts.