Information disclosure in Ai Engine
CVE-2026-16954
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and auth…
Vulnerability class: Information Disclosure
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Unknown Ai Engine — versions 0
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-16954?
- CVE-2026-16954 is a medium-severity vulnerability in Ai Engine, classified under Information Disclosure. CVSS score: 6.5/10. Published 2026-08-06.
- How severe is CVE-2026-16954?
- Medium severity. CVSS v3 base score is 6.5 out of 10.