Description
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the `getCurrentTaskResults()` method in `modules/workspace/controller.php` being accessible without authentication or authorization checks. The method is not included in the workspace controller's `getNoncedMethods()` array, the base `getPermissions()` returns an empty array, and all AJAX actions are registered with `wp_ajax_nopriv_` hooks (`classes/frame.php:282`). When tasks are created via features like the Bulk Post Generator, the task parameters — including the OpenAI API key in plaintext, AI prompts, keywords, and full AI model configuration — are stored in the database and returned in the JSON response. This makes it possible for unauthenticated attackers to enumerate sequential task IDs and retrieve sensitive configuration data including API keys.
Published: 2026-08-05
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress contains a critical authorization flaw (CWE-862). The getCurrentTaskResults() method can be called from any unauthenticated client because it is not protected by a nonces or permission checks and is exposed via an AJAX endpoint hooked with wp_ajax_nopriv_. The method returns a JSON payload that includes the task's entire configuration stored in the database, notably the OpenAI API key, prompts, keywords, and model settings. An attacker that can hit this endpoint can thus obtain sensitive credentials and configuration data.

Affected Systems

WordPress sites running the AI Copilot – Content Generator plugin in any version up to and including 1.4.6 are affected. The vulnerability exists in three key files: classes/frame.php, modules/workspace/controller.php, and modules/workspace/models/tasks.php, all of which are part of the 1.4.6 release bundle.

Risk and Exploitability

The CVSS score of 7.5 indicates a high‑severity weakness that can be exploited remotely without authentication. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the exposure of cleartext API keys makes it attractive to attackers. An attacker may simply send a GET or POST request to the exposed AJAX endpoint, iterate over sequential task identifiers, and receive JSON responses containing the plaintext configuration. No special privileges are required, and the vulnerability can be leveraged in a purely web‑based manner.

Generated by OpenCVE AI on August 5, 2026 at 08:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest patch or upgrade the AI Copilot – Content Generator plugin to a version newer than 1.4.6.
  • If an upgrade is not immediately possible, restrict unauthenticated access to the getCurrentTaskResults endpoint, for example by applying a firewall rule or by adding nonce and permission checks to the plugin’s code.
  • Rotate any exposed OpenAI API keys and other configuration data that may have been stored in plaintext, and enforce least‑privilege access controls on any remaining sensitive data.

Generated by OpenCVE AI on August 5, 2026 at 08:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wupsales
Wupsales ai Copilot – Content Generator
Vendors & Products Wordpress
Wordpress wordpress
Wupsales
Wupsales ai Copilot – Content Generator

Wed, 05 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the `getCurrentTaskResults()` method in `modules/workspace/controller.php` being accessible without authentication or authorization checks. The method is not included in the workspace controller's `getNoncedMethods()` array, the base `getPermissions()` returns an empty array, and all AJAX actions are registered with `wp_ajax_nopriv_` hooks (`classes/frame.php:282`). When tasks are created via features like the Bulk Post Generator, the task parameters — including the OpenAI API key in plaintext, AI prompts, keywords, and full AI model configuration — are stored in the database and returned in the JSON response. This makes it possible for unauthenticated attackers to enumerate sequential task IDs and retrieve sensitive configuration data including API keys.
Title AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Wordpress Wordpress
Wupsales Ai Copilot – Content Generator
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-05T06:37:54.035Z

Reserved: 2026-04-19T20:02:14.085Z

Link: CVE-2026-6639

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:15:03Z

Weaknesses