A flaw in the WordPress AI Engine plugin allows attackers to trick a logged‑in user into sending unauthorized requests to the plugin’s endpoints. The lack of CSRF protection means an attacker can perform any action the user is permitted to do—such as creating or editing content, changing settings, or executing other plugin functions—without the user’s explicit consent. This can lead to integrity violations, unwanted content submissions, and potentially other unintended changes within the WordPress site.

Meow Apps AI Engine plugin for WordPress, versions from the earliest release through 3.8.8 inclusive, are affected. Only installations of the plugin at or below 3.8.8 are vulnerable; versions 3.8.9 and later contain the fix.

The CVSS score of 8.8 marks it as a high‑severity flaw. EPSS data is unavailable, so the likelihood of exploitation remains uncertain, but the vulnerability is not listed in CISA’s KEV catalog. Because the attack path requires only the victim to be authenticated and visit a malicious site, an attacker can craft a link or embed a malicious form that, when opened in the user’s browser, triggers the vulnerable plugin to carry out the attacker‑desired actions. The resulting breach can compromise the integrity of site content and potentially expose sensitive information if the plugin processes or stores data in a way that could be abused.