CVE-2026-6804

AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actions

View on CVE.org

Published Jul 11, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to publish draft WordPress posts, exposing unpublished content, or unpublish live content, causing service disruption, by supplying arbitrary scenario IDs.

Analysis

Technical impact

The vulnerability is an authorization bypass that allows unauthenticated users to modify content through the publishTasks and unpublishTasks AJAX actions. By supplying arbitrary scenario IDs, an attacker can publish draft posts that were intended to remain hidden or unpublish posts that are already live. This can lead to exposure of sensitive content and disruption of the site’s normal publishing workflow. The weakness is a missing authorization check and is identified as CWE-862.

Affected Systems

The issue affects the Wupsales AI Copilot – Content Generator WordPress plugin, in all versions up to and including 1.4.12. The vulnerability is present in every installation of that plugin before the fix is applied. No other plugins or WordPress core components are implicated.

Risk and Exploitability

The CVSS score is 5.3, indicating a medium severity. The EPSS score of less than 1% shows a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw can be triggered as AJAX endpoints, an attacker could exploit this remotely from any network that can reach the WordPress site. The consequence for the site owner is potential data leakage and disruption of content availability.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

wupsales

AI Copilot – Content Generator

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.4.12

No data.

Vendor Product Versions

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Wupsales

Ai Copilot – Content Generator

Version	Status	Scheme	Platform
`[0,1.4.12]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the AI Copilot – Content Generator plugin to the latest version (>=1.4.13) or later to remove the missing authorization checks.
If an immediate update is not possible, block the publishTasks and unpublishTasks AJAX endpoints with a web‑application firewall, .htaccess rule, or by disabling them through server configuration.
Monitor the WordPress dashboard for any unauthorized content modifications or unexpected changes in published status to detect potential exploitation.

Generated by OpenCVE AI on August 1, 2026 at 11:39 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.561% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/frame.php#L283
https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L130
https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L141
https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L9
https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/frame.php#L283
https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L130
https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L141
https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L9
https://plugins.trac.wordpress.org/changeset?reponame=&old=3582369%40ai-copilot-content-generator&new=3582369%40ai-copilot-content-generator
https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d8ea0b-3c54-4d9d-8f14-2055510f3119?source=cve

History

Jul 14, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 13, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress Wupsales Wupsales ai Copilot – Content Generator
Vendors & Products		Wordpress Wordpress wordpress Wupsales Wupsales ai Copilot – Content Generator

Jul 11, 2026 4:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to publish draft WordPress posts, exposing unpublished content, or unpublish live content, causing service disruption, by supplying arbitrary scenario IDs.
Title		AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actions
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/frame.php#L283 https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L130 https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L141 https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L9 https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/frame.php#L283 https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L130 https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L141 https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L9 https://plugins.trac.wordpress.org/changeset?reponame=&old=3582369%40ai-copilot-content-generator&new=3582369%40ai-copilot-content-generator https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d8ea0b-3c54-4d9d-8f14-2055510f3119?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`