CVE-2026-6804
published 2026-07-11CVE-2026-6804: The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is…
PriorityP335medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.56%
45.5th percentile
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to publish draft WordPress posts, exposing unpublished content, or unpublish live content, causing service disruption, by supplying arbitrary scenario IDs.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wupsales | ai_copilot_content_generator | <= 1.4.12 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
wupsales AI Copilot Plugin up to 1.4.12 on WordPress Authorization authorization (EUVD-2026-43144)
vuldb·2026-07-11·CVSS 5.3
CVE-2026-6804 [MEDIUM] wupsales AI Copilot Plugin up to 1.4.12 on WordPress Authorization authorization (EUVD-2026-43144)
A vulnerability classified as critical was found in wupsales AI Copilot Plugin up to 1.4.12 on WordPress. This affects an unknown function of the component Authorization. The manipulation results in authorization bypass.
This vulnerability was named CVE-2026-6804. The attack may be performed from remote. There is no available exploit.
GHSA
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12.
ghsa_unreviewed·2026-07-11
CVE-2026-6804 [MEDIUM] CWE-862 The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12.
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to publish draft WordPress posts, exposing unpublished content, or unpublish live content, causing service disruption, by supplying arbitrary scenario IDs.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/frame.php#L283https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L130https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L141https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L9https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/frame.php#L283https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L130https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L141https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L9https://plugins.trac.wordpress.org/changeset?reponame=&old=3582369%40ai-copilot-content-generator&new=3582369%40ai-copilot-content-generatorhttps://www.wordfence.com/threat-intel/vulnerabilities/id/b6d8ea0b-3c54-4d9d-8f14-2055510f3119?source=cve
2026-07-11
Published