What is GHSA-9wjr-j39x-f62m?

GHSA-9wjr-j39x-f62m is a security advisory published by GitHub Security Advisories with Medium severity. The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before...

Which CVE IDs does GHSA-9wjr-j39x-f62m cover?

GHSA-9wjr-j39x-f62m covers the following CVE IDs: CVE-2026-16954. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9wjr-j39x-f62m?

GHSA-9wjr-j39x-f62m has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-9wjr-j39x-f62mMediumCVSS 6.5

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before...

Vendor

GitHub Security Advisories

Published

August 6, 2026

Last Modified

August 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-16954 →

📋 Description

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16954
https://wpscan.com/vulnerability/badce355-e6ce-4dd4-8d9b-c87a7b9db12f
https://github.com/advisories/GHSA-9wjr-j39x-f62m