Technical impact
The CVE is a missing authorization flaw that lets attackers exploit incorrectly configured access control security settings in the Meow Apps AI Engine plugin. By bypassing expected authorization checks, a user with minimal or no privileges could perform privileged operations, access sensitive data or configure the plugin in ways that could further compromise the WordPress site. The vulnerability does not provide direct remote code execution but can be leveraged to expand an attacker’s foothold within the affected application.
Affected Systems
WordPress sites running the Meow Apps AI Engine plugin, version 3.8.6 or earlier. The vulnerability is present in all releases up to and including 3.8.6; newer versions (3.8.7 and later) contain the fix.
Risk and Exploitability
The CVSS score of 4.3 indicates a moderate severity. No EPSS entry is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the web interface of a WordPress installation where the AI Engine plugin is installed; an attacker could exploit the flaw by accessing protected plugin functionality using a low‑privilege or unauthenticated account. The flaw can be exploited without special host or network infrastructure, making it potentially accessible to a broad threat pool.
