Description
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page-s inline script data, allowing users with the Editor role to read the site-s stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.
CVSS 6.5EPSS 0.249%Risk 0.66
View source- Published
- 2026-08-06 07:16:28
- Last modified
- 2026-08-06 15:16:44
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N