CVE-2026-104741 in AI Puffer Plugin
Summary
by MITRE • 10/10/2026
The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global plugin indexing and vector-search configuration options (aipkit_training_general_settings and aipkit_indexing_field_settings), including chunking parameters, file upload visibility, and per-CPT field indexing settings, affecting all users of the plugin. This is only exploitable in configurations where an administrator has granted 'sources' module access to a lower-privileged role via the plugin's Role Manager.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The AI Puffer – Chat. Create. Automate WordPress plugin, previously known as AI Power, contains a critical authorization bypass vulnerability affecting all versions up to and including 2.4.89. This security flaw stems from an insufficient verification of user privileges when handling specific administrative configuration endpoints within the plugin's architecture. The issue allows authenticated attackers with subscriber-level access or higher to manipulate global settings that control how the AI system indexes data and performs vector searches. These settings include critical parameters such as chunking configurations, file upload visibility rules, and per-custom post type field indexing options. Because these configurations are applied globally across all users of the plugin, a successful exploitation can have widespread consequences for the integrity and security of the entire WordPress installation's AI-driven features.
The technical root cause lies in the failure to properly enforce role-based access control on specific API endpoints or administrative actions responsible for updating the aipkit_training_general_settings and aipkit_indexing_field_settings options. In a secure implementation, any request modifying global plugin state should require administrator-level privileges regardless of other module-specific permissions granted by lower-privileged roles. However, in this vulnerable version, the authorization logic does not adequately distinguish between general administrative actions and those restricted to high-privilege users when interacting with these specific configuration arrays. This oversight enables attackers who have been granted access to the sources module via the plugin's Role Manager feature to escalate their effective privileges within the context of AI data processing configurations.
The operational impact of this vulnerability is significant, particularly in environments where administrators have delegated partial control over the AI features to lower-privileged users such as editors or subscribers for convenience or workflow optimization. By exploiting this authorization bypass, an attacker can alter how content is chunked and indexed for vector search operations. This manipulation could lead to data leakage if file upload visibility settings are changed to expose sensitive documents that were previously restricted. Furthermore, modifying per-CPT field indexing settings might allow the injection of malicious prompts or the extraction of proprietary information stored in custom post types by altering which fields are exposed to the AI model's context window. The ability to change these global parameters means a single compromised low-privilege account can destabilize the entire plugin's functionality and compromise data confidentiality for all users relying on its services.
This vulnerability aligns with CWE-269, Improper Privilege Management, as it involves an actor obtaining privileges that they are not explicitly authorized to hold within the application logic. From a tactical perspective, this exploitation technique corresponds to ATT&CK T1078, Valid Accounts, specifically leveraging legitimate user credentials and roles to perform unauthorized administrative actions. The attack vector is remote but requires prior authentication, classifying it as an authenticated insider threat or compromised account scenario rather than an unauthenticated external exploit.
To mitigate this risk, site administrators should immediately update the AI Puffer plugin to a version newer than 2.4.89 where the authorization checks have been corrected to strictly enforce administrator-only access for global configuration changes. In cases where updating is not immediately feasible, it is crucial to review and restrict the Role Manager settings within the plugin. Administrators should revoke any granted sources module access from lower-privileged roles such as subscribers or contributors until a patch can be applied. Additionally, implementing strict input validation and ensuring that all administrative actions trigger comprehensive privilege checks against the WordPress core user capabilities rather than relying solely on custom role definitions will help prevent similar authorization bypasses in future updates. Regular auditing of plugin configurations and monitoring for unexpected changes to global settings can also aid in early detection of such exploitation attempts.