CVE-2026-6804: WordPress AIWU Plugin Auth Bypass Flaw

CVE-2026-6804 Overview

CVE-2026-6804 is an authorization bypass vulnerability [CWE-862] affecting the AI Chatbot & Workflow Automation by AIWU plugin for WordPress. All versions up to and including 1.4.12 fail to verify whether a requesting user is authorized to perform post-state actions. Unauthenticated attackers can supply arbitrary scenario IDs to publish draft posts or unpublish live content. The flaw exposes unreleased content and enables service disruption on affected WordPress sites.

Critical Impact
Unauthenticated network attackers can alter WordPress post publication states, exposing draft content and disrupting the availability of live posts without any user interaction.

Affected Products

AI Chatbot & Workflow Automation by AIWU plugin for WordPress
All versions up to and including 1.4.12
WordPress sites with the ai-copilot-content-generator plugin installed

Discovery Timeline

2026-07-11 - CVE-2026-6804 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-6804

Vulnerability Analysis

The vulnerability resides in the plugin's workspace controller logic, which handles scenario execution requests. The controller accepts scenario ID parameters from HTTP requests and processes actions against WordPress posts without validating the requester's identity or capabilities. As a result, an unauthenticated attacker can invoke privileged post-state transitions by referencing arbitrary scenario IDs.

Successful exploitation produces two primary outcomes. Attackers can transition draft posts to a published state, exposing unreleased content such as embargoed announcements or internal drafts. Attackers can also unpublish live posts, removing them from public view and causing content availability disruption.

The issue affects integrity and availability of WordPress content but does not directly expose credentials or grant code execution. EPSS data lists a probability of 0.353% with a percentile of 27.7 as of 2026-07-20.

Root Cause

The root cause is a missing authorization check [CWE-862] in the plugin's request handlers. The affected controller entry points do not call WordPress capability checks such as current_user_can() or verify nonces before acting on the supplied scenario ID. Any anonymous HTTP request that reaches the vulnerable endpoint is treated as authorized.

Attack Vector

The attack vector is remote and network-based. An attacker sends crafted HTTP requests to the plugin's exposed action endpoints with attacker-chosen scenario IDs. No authentication, credentials, or user interaction are required. The vulnerable code paths are documented in the plugin source at WordPress Plugin Controller Code and WordPress Plugin Frame Code.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-6804

Indicators of Compromise

Unexpected transitions of WordPress posts from draft or pending status to publish without a matching authenticated user session in audit logs.
Previously live posts moved to draft or trash status without a corresponding administrator action.
HTTP requests to plugin action endpoints under the ai-copilot-content-generator path from unauthenticated sources.
Anomalous scenario ID parameters submitted in POST or GET requests targeting the plugin controller.

Detection Strategies

Monitor the WordPress wp_posts table for post_status changes that lack an associated authenticated post_modified audit trail.
Inspect web server access logs for requests referencing the AIWU plugin controller endpoints originating from unauthenticated sessions.
Deploy a Web Application Firewall (WAF) rule to flag requests to plugin endpoints that carry a scenario ID parameter but no valid WordPress authentication cookie or nonce.

Monitoring Recommendations

Enable WordPress activity logging plugins to record all post status transitions with actor attribution.
Alert on post publication or unpublication events occurring outside of business hours or from IPs with no prior authenticated activity.
Track the volume of requests to wp-admin/admin-ajax.php and REST endpoints associated with the AIWU plugin for anomalous spikes.

How to Mitigate CVE-2026-6804

Immediate Actions Required

Update the AI Chatbot & Workflow Automation by AIWU plugin to a version later than 1.4.12 as soon as the vendor releases a fixed release.
Disable or remove the plugin if a patched version is not yet available and the functionality is not business-critical.
Audit all WordPress posts to identify any unauthorized publication or unpublication events since the plugin was installed.

Patch Information

The plugin repository shows a code change tracked in the WordPress Plugin Changeset. Administrators should confirm that the installed plugin version incorporates the authorization check fix by comparing against the referenced changeset and by consulting the Wordfence Vulnerability Analysis.

Workarounds

Restrict access to the plugin's controller endpoints at the web server or WAF layer, denying requests without a valid authenticated WordPress session.
Temporarily deactivate the AIWU plugin from the WordPress admin console until an official fix is applied.
Enforce the principle of least privilege on WordPress author and editor accounts, and require multi-factor authentication for all publishing-capable users.

bash

# Example nginx rule to block unauthenticated access to plugin controller endpoints
location ~* /wp-content/plugins/ai-copilot-content-generator/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}