AI Puffer – Chat. Create. Automate. (formerly AI Power) <= 2.4.89 - Authenticated (Knowledge Base Access) Missing Authorization to Semantic Search Settings Update
- ID
- WPSEC-2026-0389
- Plugin
- AI Puffer – Chat. Create. Automate. (formerly AI Power) (gpt3-ai-content-generator)
- Affected
- from 2.4.54 before 2.4.90
- Remediation
- Update to 2.4.90 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- AI Puffer – Chat. Create. Automate. (formerly AI Power) on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-104742, on 2026-10-09.
Description
The AI Puffer plugin for WordPress is vulnerable to unauthorized modification of data in versions 2.4.54 up to, and including, 2.4.89. The AJAX handler that saves the semantic search settings accepted either Settings or Knowledge Base module access, although these options apply to the whole site. This makes it possible for authenticated users whose role an administrator has granted Knowledge Base module access, but not Settings access, to change the site-wide semantic search configuration, including the vector store, embedding provider and model, number of results and no-results text. All plugin modules are restricted to administrators by default.
References
- https://wpsec.com/vuln/WPSEC-2026-0389/
- https://plugins.svn.wordpress.org/gpt3-ai-content-generator/tags/2.4.90/
- https://wordpress.org/plugins/gpt3-ai-content-generator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS