CVE-2026-104742 Details
Description
The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global site-wide semantic search settings, including vector provider, embedding provider, embedding model, target ID, number of results, and no-results text stored in aipkit_options, that are otherwise restricted to administrators. Exploitation requires that an administrator has previously granted the Knowledge Base ('sources') module to the attacker's role via the Role Manager, as this access is not available to lower-privileged users by default.
A vulnerability exists in the AI Puffer – Chat. Create. Automate. plugin for WordPress, in all versions through 2.4.89. The issue stems from the plugin's failure to properly verify user authorization for certain actions. This flaw enables authenticated attackers with subscriber-level access or higher to alter global semantic search settings that are typically reserved for administrators. The settings that can be modified include the vector provider, embedding provider, embedding model, target ID, number of results, and no-results text, all of which are stored in the aipkit_options. To exploit this vulnerability, an administrator must have previously granted the Knowledge Base ('sources') module to the attacker's role via the Role Manager, as this access is not available to lower-privileged users by default.
Users are advised to update the AI Puffer WordPress plugin to version 2.4.90 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AI Puffer | <= 2.4.89 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 11, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |