CVE-2026-93623 Overview
CVE-2026-93623 is an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in the AI Engine WordPress plugin through version 3.7.8. The flaw allows remote attackers to access resources belonging to other users without authentication by manipulating object identifiers in requests. The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Unauthenticated attackers can reference objects belonging to other users over the network, resulting in unauthorized disclosure of low-severity information from affected AI Engine installations.
Affected Products
- AI Engine WordPress plugin versions up to and including 3.7.8
- WordPress sites running the vulnerable AI Engine plugin
- Any deployment exposing AI Engine endpoints to untrusted networks
Discovery Timeline
- 2026-09-23 - CVE-2026-93623 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-93623
Vulnerability Analysis
The AI Engine plugin fails to enforce authorization checks when handling references to internal objects. Requests that supply an identifier for a resource are processed without validating that the requester is authorized to access the referenced object. Because authentication is not required, any remote user reachable over the network can issue crafted requests to retrieve data intended for other users.
The impact is limited to confidentiality. Integrity and availability are not affected according to the CVSS metrics. This aligns with the [CWE-639] classification, where authorization decisions depend on a user-controlled key rather than server-side session or role validation.
Root Cause
The root cause is missing or insufficient access control in request handlers that resolve object identifiers. The plugin trusts client-supplied keys such as record IDs, chat identifiers, or resource references without cross-checking ownership. This design defect enables attackers to substitute identifiers and read data they should not have access to.
Attack Vector
Exploitation occurs over the network with low complexity and requires no privileges or user interaction. An attacker enumerates or guesses valid object identifiers and issues HTTP requests directly to vulnerable AI Engine endpoints. Successful requests return data associated with the referenced identifier rather than the requester's own scope. Refer to the Patchstack AI Engine Plugin Vulnerability advisory for further technical context.
No verified proof-of-concept code is publicly available. The vulnerability mechanism is described in prose rather than with synthetic exploitation code.
Detection Methods for CVE-2026-93623
Indicators of Compromise
- Unauthenticated HTTP requests to AI Engine REST endpoints that reference sequential or enumerated object identifiers.
- Access log patterns showing a single source iterating identifier parameters against /wp-json/ routes exposed by the plugin.
- Responses containing content belonging to accounts other than the requesting client, particularly when the client is unauthenticated.
Detection Strategies
- Inspect web server and WordPress logs for high-volume unauthenticated requests targeting AI Engine endpoints.
- Correlate response sizes and object identifier parameters to identify enumeration behavior.
- Deploy web application firewall rules that flag anomalous identifier iteration against plugin routes.
Monitoring Recommendations
- Continuously monitor requests to AI Engine endpoints for unauthenticated access patterns.
- Alert on bursts of 4xx responses interleaved with successful 200 responses across sequential identifiers.
- Track outbound data volumes from WordPress hosts to detect bulk retrieval of user records.
How to Mitigate CVE-2026-93623
Immediate Actions Required
- Upgrade the AI Engine plugin to a version later than 3.7.8 once a fixed release is available from the vendor.
- Restrict network access to WordPress administrative and REST endpoints where feasible.
- Audit plugin logs for prior evidence of identifier enumeration or unauthorized object access.
Patch Information
Refer to the Patchstack advisory for AI Engine for the latest patch guidance. Administrators should apply the vendor-supplied update as soon as it is published and validate the running version after upgrade.
Workarounds
- Deploy a web application firewall rule that blocks unauthenticated requests to AI Engine object retrieval endpoints.
- Disable the AI Engine plugin until a patched version is installed if the functionality is not business critical.
- Enforce authentication requirements on all /wp-json/ routes exposed by the plugin using server-side access controls.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.