What is GHSA-m6p4-v4cr-fqfp?

GHSA-m6p4-v4cr-fqfp is a security advisory published by GitHub Security Advisories with Medium severity. The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of...

Which CVE IDs does GHSA-m6p4-v4cr-fqfp cover?

GHSA-m6p4-v4cr-fqfp covers the following CVE IDs: CVE-2026-75798. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m6p4-v4cr-fqfp?

GHSA-m6p4-v4cr-fqfp has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-m6p4-v4cr-fqfpMediumCVSS 5.3

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of...

Vendor

GitHub Security Advisories

Published

August 26, 2026

Last Modified

August 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-75798 →

📋 Description

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-75798
https://wpscan.com/vulnerability/a77168df-61b8-40df-95f5-e19cf6540ce5
https://github.com/advisories/GHSA-m6p4-v4cr-fqfp