The AI Engine WordPress plugin, before version 3.6.4, fails to redact secret configuration values when rendering them in an admin page’s inline script. This results in a CWE‑200 Information Exposure flaw, allowing users with the Editor role to view the stored third‑party API key and bearer tokens in cleartext, despite those secrets being normally restricted to administrators. An attacker with Editor privileges can thus capture these credentials, using them to compromise external services or gain further access to the site, thereby breaching confidentiality. The likely attack vector is via the web interface when an Editor accesses the admin page.

Any WordPress site running the AI Engine plugin at a version older than 3.6.4 is affected. The issue arises when the plugin renders configuration data within an admin dashboard page. Editors—or higher roles that can view that page—can read the exposed API keys and bearer tokens. No vendor‑specific product list beyond the generic AI Engine WordPress plugin is provided, and the problem applies to all installations of this plugin before the 3.6.4 release.

The flaw is exploitable through the web interface and requires a user with Editor privileges, a common role. The CVSS score is 6.5, placing it in the medium severity range, and the EPSS score is <1%, indicating a low probability of exploitation, though it is not listed in the CISA KEV catalog. Because the secrets are presented in plaintext to an elevated‑role user, the security risk remains medium. Exploitation is straightforward: log in as an Editor, open the affected admin page, and copy the inline script containing the credentials; no additional prerequisites are listed.