The AI Engine (Pro) WordPress plugin contains a missing authorization flaw that allows an attacker to use plugin endpoints without proper permission. The vulnerability can lead to unauthorized access to, modification of, or disclosure of plugin‑maintained data, exposing the site’s administrative features or content. This is a classic Missing Privilege enforcement weakness (CWE‑862).

The affected product is Jordy Meow’s AI Engine (Pro) plugin. Any released version prior to 3.4.2 is vulnerable, as the vulnerability exists from the initial release through all earlier versions. Users running versions older than 3.4.2 on WordPress sites are at risk.

The CVSS base score of 4.3 indicates moderate severity, and the EPSS of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exposures typically arise from web requests to the plugin’s admin interface; an attacker may not need elevated privileges if the site’s configuration allows broad access to the plugin’s endpoints. The exact attack vector is inferred from the description of a missing authorization check.