{"id":"CVE-2026-12510","aliases":["EUVD-2026-44874","GHSA-8rhw-c8ph-cp97"],"status":"published","title":"AI Engine \u003c 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR","description":"The AI Engine  WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00232,"percentile":0.14179,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-07-16T06:00:03Z","modified":"2026-07-16T18:31:30Z","products":[{"vendor":"jordy meow","product":"ai engine"},{"vendor":"unknown","product":"ai engine"}],"references":[{"url":"https://wpscan.com/vulnerability/b7825c8a-1817-4a17-b641-076e48ac7c2e/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12510"},{"url":"https://wpscan.com/vulnerability/b7825c8a-1817-4a17-b641-076e48ac7c2e"},{"url":"https://github.com/advisories/GHSA-8rhw-c8ph-cp97"}],"sources":{"cve":[{"id":"CVE-2026-12510","title":"AI Engine \u003c 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR","description":"The AI Engine  WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.","status":"published","published":"2026-07-16T06:00:03.59Z","modified":"2026-07-16T15:33:27.561Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-44874","description":"The AI Engine  WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.","status":"published","published":"2026-07-16T06:00:03Z","modified":"2026-07-16T15:33:27Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:51.364603Z"}],"ghsa":[{"id":"GHSA-8rhw-c8ph-cp97","title":"The AI Engine  WordPress plugin before 3.5.5 does not verify that a user owns the chatbot...","description":"The AI Engine  WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.","status":"published","published":"2026-07-16T09:32:16Z","modified":"2026-07-16T18:31:30Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:09:33.90316Z"}],"nvd":[{"id":"CVE-2026-12510","description":"The AI Engine  WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.","status":"published","published":"2026-07-16T07:16:46.877Z","modified":"2026-07-16T16:18:59.75Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:30.250437Z"}]}}