CVE-2026-96561

Description

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes 'model_' back to 'model', allowing an unauthenticated caller to place an attacker-controlled string (including CR/LF) into $query->model; final_checks() throws an Exception whose message embeds that raw string, and the non-streaming, non-admin catch branch writes it to the PHP error log unmodified — creating a forged log line that the plugin's own parser subsequently returns as recent PHP-error content; run_advisor() then appends that content verbatim to the AI prompt (indirect prompt injection — CWE-1427), the returned JSON is stored in the mwai_advisor_data option with no schema validation or HTML sanitization, and advisor_metabox() concatenates the resulting 'title' and 'description' values directly into the WordPress dashboard widget without esc_html(), wp_kses(), or equivalent escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the WordPress dashboard.

Gravité et risque d'exploitation

CVE-2026-96561 obtient un score CVSS de 7.2/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.33 %, ce qui la place devant 24.5 % des CVE référencées.

Que faire ?

• Vérifiez si AI Engine – The Chatbot, AI Framework & MCP for WordPress (versions 0, <=3.8.0) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://www.wordfence.com/threat-intel/vulnerabilities/id/910e51da-6ee2-45d5-837b-7fea80f79390?source=cve
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/advisor.php#L216
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/advisor.php#L162
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/advisor.php#L156
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/common/helpers.php#L251
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/chatbot.php#L299
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/engines/core.php#L533
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/query/base.php#L360
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/chatbot.php#L597
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/rest.php#L464
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/chatbot.php#L122
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fai-engine%2Ftags%2F3.8.0&new_path=%2Fai-engine%2Ftags%2F3.8.1