What happened
Patchstack published CVE-2026-110888 on 2026-10-15 (NVD REST verified, CVSS 4.3, CWE-862, status Deferred). The AI Engine plugin lacks proper authorization in vulnerable surfaces through 3.8.3, enabling exploitation of misconfigured access control security levels. Patchstack rates it low-priority and unlikely to be exploited at scale.
Why it matters
AI Engine is a common WordPress AI-chat/AI-assistant plugin; this is a precise but low-blast-radius catalogue entry — an access-control gap on an AI plugin that can let a low-privilege WordPress user reach AI features or adjacent data they should not, worth patching alongside the normal WordPress plugin maintenance cadence.
Attack vector
A missing authorization check (CWE-862) in AI Engine — a WordPress AI-chat/AI-agent plugin — allows exploiting incorrectly configured access-control levels; an authenticated low-privilege caller can perform actions or reach data beyond their granted level.
Affected systems
WordPress 'AI Engine' plugin (Meow Apps) <= 3.8.3 (fixed in 3.8.4)
Mitigation
Update the AI Engine plugin to 3.8.4 or later (Patchstack advisory; reported 2026-10-02, published 2026-10-15). Patchstack auto-update enabled customers were patched pre-publication.