AI Puffer – Chat. Create. Automate. (formerly AI Power) <= 2.4.89 - Authenticated (Knowledge Base Access) Missing Authorization to Content Indexing Settings Update
- ID
- WPSEC-2026-0390
- Plugin
- AI Puffer – Chat. Create. Automate. (formerly AI Power) (gpt3-ai-content-generator)
- Affected
- from 2.3.27 before 2.4.90
- Remediation
- Update to 2.4.90 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- AI Puffer – Chat. Create. Automate. (formerly AI Power) on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-104741, on 2026-10-09.
Description
The AI Puffer plugin for WordPress is vulnerable to unauthorized modification of data in versions 2.3.27 up to, and including, 2.4.89. The ajax_save_cpt_indexing_options AJAX handler, which saves the site-wide content indexing settings, required only Knowledge Base module access. This makes it possible for authenticated users whose role an administrator has granted Knowledge Base module access, but not Settings access, to change which post types, custom fields, taxonomies and labels are included when site content is indexed, along with related indexing options. All plugin modules are restricted to administrators by default.
References
- https://wpsec.com/vuln/WPSEC-2026-0390/
- https://plugins.svn.wordpress.org/gpt3-ai-content-generator/tags/2.4.90/
- https://wordpress.org/plugins/gpt3-ai-content-generator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS