What happened
Seed-verified via WPScan reference (published Oct 21): the plugin does not check that the caller may edit the targeted object before updating title/excerpt, letting Editors modify post types they cannot otherwise edit.
Why it matters
AI/LLM WordPress plugins increasingly expose programmatic content-mutation endpoints; missing object-level authorization here allows privilege escalation over site content via the AI feature surface.
Attack vector
An authorized plugin user with the Editor role invokes the affected AI-action update path without a capability/object-ownership check, changing target post titles/excerpts cross-object.
Affected systems
AI Engine WordPress plugin < 3.8.6
Mitigation
Update AI Engine to 3.8.6+ (Wordfence/WPScan advisory 59f18552-e60e-466f-949d-cc09aa657bbe).