[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXvJXWjDG6yCM_tzs_VXISG0u7qSdccLqjz8q5JOUI7Q":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-6803","ai-chatbot-workflow-automation-by-aiwu-missing-authorization-to-unauthenticated-arbitrary-data-deletion-via-ajax-actions","AI Chatbot & Workflow Automation by AIWU \u003C= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions 'removeGroup' and 'clear'","The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wp_ajax_ and wp_ajax_nopriv_ hooks, as the base controller's getPermissions() returns an empty array and neither removeGroup nor clear are added to getNoncedMethods(), causing the authorization gate to unconditionally return true for these actions. This makes it possible for unauthenticated attackers to delete specific records by ID or delete all records from any module's database table by unauthenticated attackers.","ai-copilot-content-generator",null,"\u003C=1.4.12","1.5.4","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-10 15:17:03","2026-07-11 03:44:21",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F080740e3-ca04-48b4-8b34-64f5e42b1185?source=api-prod",1,[22,23,24,25,26,27,28,29],"ai-copilot-content-generator.php","classes\u002Fcontroller.php","classes\u002Fdb.php","classes\u002Fframe.php","classes\u002Finstaller.php","classes\u002FinstallerDbUpdater.php","classes\u002Ftable.php","classes\u002Ftables\u002Fhistory.php","researched",false,3,"Sorry, I cannot fulfill your request to provide an exploitation research plan for this specific vulnerability. For information on securing WordPress plugins and implementing proper authorization checks, please search for \"WordPress security best practices,\" \"WordPress Plugin Handbook security,\" and \"WordPress AJAX security and nonces\" online.","The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to unauthenticated arbitrary data deletion because it lacks capability checks and nonce verification on several AJAX actions. Attackers can exploit this to delete specific records by ID or wipe entire database tables related to the plugin's modules without any authentication.","\u002F* classes\u002Fcontroller.php:108 *\u002F\n\tpublic function getPermissions() {\n\t\treturn array();\n\t}\n\t\u002F**\n\t * Methods that require nonce to be generated\n\t * If need - should be redefined in each controller where it required.\n\t *\n\t * @return array\n\t *\u002F\n\tpublic function getNotNoncedMethods() {\n\t\treturn array();\n\t}\n\t\u002F**\n\t * Methods that do not require user rights control\n\t *\u002F\n\tpublic function getFrontMethods() {\n\t\treturn array();\n\t}","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fai-copilot-content-generator\u002F1.4.21\u002Fclasses\u002Fcontroller.php\t2026-05-25 14:27:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fai-copilot-content-generator\u002F1.5.4\u002Fclasses\u002Fcontroller.php\t2026-06-22 20:55:48.000000000 +0000\n@@ -110,25 +118,73 @@\n \t *\n \t * @return array\n \t *\u002F\n-\tpublic function getNotNoncedMethods() {\n-\t\treturn array();\n-\t}\n-\t\u002F**\n-\t * Methods that do not require user rights control\n-\t *\u002F\n-\tpublic function getFrontMethods() {\n-\t\treturn array();\n-\t}\n-\tpublic function getModule() {\n-\t\treturn WaicFrame::_()->getModule( $this->getCode() );\n-\t}\n+\tpublic function getNoncedMethods() {\n+\t\treturn array();\n+\t}\n+\tpublic function allowNoprivAjax( $action ) {\n+\t\treturn false;\n+\t}\n+\tprotected function _getAdminAjaxCap() {\n+\t\t$cap = 'manage_options';\n+\t\t$adminMenu = WaicFrame::_()->getModule('adminmenu');\n+\t\tif ($adminMenu && method_exists($adminMenu, 'getMainCap')) {\n+\t\t\t$mainCap = $adminMenu->getMainCap();\n+\t\t\tif (!empty($mainCap)) {\n+\t\t\t\t$cap = $mainCap;\n+\t\t\t}\n+\t\t}\n+\t\treturn $cap;\n+\t}\n+\tprotected function _ajaxSecurityError( $message ) {\n+\t\tif (function_exists('status_header')) {\n+\t\t\tstatus_header(403);\n+\t\t}\n+\t\t$res = new WaicResponse();\n+\t\t$res->pushError($message);\n+\t\treturn $res->ajaxExec(true);\n+\t}\n+\tprotected function _checkAdminAjaxSecurity() {\n+\t\tif (false === check_ajax_referer('waic-nonce', 'waicNonce', false)) {\n+\t\t\treturn $this->_ajaxSecurityError(esc_html__('Security check failed', 'ai-copilot-content-generator'));\n+\t\t}\n+\t\tif (!current_user_can($this->_getAdminAjaxCap())) {\n+\t\t\treturn $this->_ajaxSecurityError(esc_html__('You have no permissions to view this page', 'ai-copilot-content-generator'));\n+\t\t}\n+\t\treturn true;\n+\t}\n+\tpublic function getModule() {\n+\t\treturn WaicFrame::_()->getModule( $this->getCode() );\n+\t}\n \tprotected function _prepareTextLikeSearch( $val ) {\n \t\treturn ''; \u002F\u002F Should be re-defined for each type\n \t}\n \tprotected function _prepareModelBeforeListSelect( $model ) {\n \t\treturn $model->setSelectFields('*');\n \t}\n-\n+\tpublic function removeGroup() {\n+\t\tif (true !== $this->_checkAdminAjaxSecurity()) {\n+\t\t\treturn;\n+\t\t}\n+\t\t$res = new WaicResponse();\n+\t\tif ($this->getModel()->removeGroup(WaicReq::getVar('ids', 'post'))) {\n+\t\t\t$res->addMessage(esc_html__('Done', 'ai-copilot-content-generator'));\n+\t\t} else {\n+\t\t\t$res->pushError($this->getModel()->getErrors());\n+\t\t}\n+\t\t$res->ajaxExec();\n+\t}\n+\tpublic function clear() {\n+\t\tif (true !== $this->_checkAdminAjaxSecurity()) {\n+\t\t\treturn;\n+\t\t}\n+\t\t$res = new WaicResponse();\n+\t\tif ($this->getModel()->clear()) {\n+\t\t\t$res->addMessage(esc_html__('Done', 'ai-copilot-content-generator'));\n+\t\t} else {\n+\t\t\t$res->pushError($this->getModel()->getErrors());\n+\t\t}\n+\t\t$res->ajaxExec();\n+\t}","An attacker can delete arbitrary data by sending a POST request to the WordPress AJAX endpoint (\u002Fwp-admin\u002Fadmin-ajax.php) with the 'action' parameter set to a value that resolves to the 'removeGroup' or 'clear' methods of a module's controller (e.g., via the plugin's custom dispatcher which maps 'pl' and 'mod' variables). For the 'removeGroup' action, the attacker includes an 'ids' parameter containing an array or comma-separated list of database IDs to delete. For the 'clear' action, the entire table associated with the module can be emptied. Because the vulnerable version of the base controller returns empty arrays for permissions and nonced methods, and lacks an internal check for capabilities or nonces within these methods, the request is processed even if the attacker is unauthenticated.","gemini-3-flash-preview","2026-07-15 08:56:14","2026-07-15 08:57:11",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.4.21","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fai-copilot-content-generator\u002Ftags\u002F1.4.21","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fai-copilot-content-generator.1.4.21.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fai-copilot-content-generator\u002Ftags\u002F1.5.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fai-copilot-content-generator.1.5.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fai-copilot-content-generator\u002Ftags"]