AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens

published 2026-08-06 3 mo ago modified 2026-08-26 2 mo ago also EUVD-2026-53726

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits: 0; none known

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.

Patch / fix

fixed in 1

Unknown AI Engine 3.6.4

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-08-06)

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

wpscan.com https://wpscan.com/vulnerability/badce355-e6ce-4dd4-8d9b-c87a7b9db12f/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Unknown AI Engine

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Technology feeds

WordPress rss critical rss

References

wpscan.com /vulnerability/badce355-e6ce-4dd4-8d9b-c87a7b9db12f/
exploit, vdb-entry, technical-description

Sources

CVE List CVE-2026-16954
NVD CVE-2026-16954

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary