[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBd9KdMUBTsFvrgx5HQyRDtZOzdstnxe2-nPPZTp_Rac":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-6804","ai-chatbot-workflow-automation-by-aiwu-missing-authorization-to-unauthenticated-arbitrary-modification-via-publishtasks-","AI Chatbot & Workflow Automation by AIWU \u003C= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actions","The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to publish draft WordPress posts, exposing unpublished content, or unpublish live content, causing service disruption, by supplying arbitrary scenario IDs.","ai-copilot-content-generator",null,"\u003C=1.4.12","1.5.4","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-10 15:18:07","2026-07-11 03:44:25",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb6d8ea0b-3c54-4d9d-8f14-2055510f3119?source=api-prod",1,[22,23,24,25,26,27,28,29],"ai-copilot-content-generator.php","classes\u002Fcontroller.php","classes\u002Fdb.php","classes\u002Fframe.php","classes\u002Finstaller.php","classes\u002FinstallerDbUpdater.php","classes\u002Ftable.php","classes\u002Ftables\u002Fhistory.php","researched",false,3,"I cannot fulfill your request to produce a detailed, technical exploitation research plan or specific HTTP payloads for CVE-2026-6804. Providing actionable instructions for exploiting vulnerabilities in specific software, even for research or testing purposes, can facilitate unauthorized access and real-world harm.\n\nInstead, I can explain the mechanics of \"Missing Authorization\" vulnerabilities in the context of WordPress plugins and how developers can properly secure AJAX endpoints.\n\n### Understanding Missing Authorization in WordPress\n\nA \"Missing Authorization\" vulnerability occurs when an application provides access to sensitive functionality or data without properly verifying the identity and permissions of the requester. In WordPress plugins, this often happens within AJAX handlers or REST API endpoints.\n\n#### 1. The Role of `admin-ajax.php`\nWordPress uses `admin-ajax.php` to handle asynchronous requests. Plugins register these handlers using two hooks:\n*   `wp_ajax_{action}`: Fires for authenticated (logged-in) users.\n*   `wp_ajax_nopriv_{action}`: Fires for unauthenticated (logged-out) users.\n\nIf a developer uses the `nopriv` hook for a sensitive action—such as modifying post statuses or accessing internal task configurations—without implementing internal permission checks, any visitor to the site can trigger that action.\n\n#### 2. Authorization vs. Authentication\n*   **Authentication** proves who a user is.\n*   **Authorization** determines what they are allowed to do.\n\nA vulnerability exists when a function assumes that because a user is \"logged in\" or because they provided a valid \"nonce,\" they are authorized to perform any action. In WordPress, authorization is typically handled via **Capabilities**.\n\n### Defensive Remediation\n\nTo prevent authorization bypasses, developers should follow these security practices:\n\n#### Implement Capability Checks\nEvery sensitive AJAX handler should check if the current user has the appropriate permissions before executing logic. This is done using the `current_user_can()` function.\n\n```php\nadd_action( 'wp_ajax_my_sensitive_action', 'handle_sensitive_action' );\n\nfunction handle_sensitive_action() {\n    \u002F\u002F 1. Authorization: Check if the user has the necessary capability\n    if ( ! current_user_can( 'edit_posts' ) ) {\n        wp_send_json_error( 'Unauthorized', 403 );\n    }\n\n    \u002F\u002F 2. Nonce Verification: Protect against CSRF\n    check_ajax_referer( 'my_action_nonce', 'nonce' );\n\n    \u002F\u002F 3. Process the request\n    \u002F\u002F ...\n}\n```\n\n#### Proper Use of Nonces\nNonces (Number Used Once) in WordPress are primarily CSRF (Cross-Site Request Forgery) protection, not an authorization mechanism. A valid nonce only proves that the request was likely intended by the user; it does not prove the user has the right to perform the action. \n\n#### Avoid `nopriv` for Administrative Tasks\nFunctionality that modifies site data, configuration, or content status should generally not be exposed via `wp_ajax_nopriv_` hooks unless there is a specific, well-secured use case (such as a public-facing form with its own strict validation and rate limiting).\n\n### Security Resources\nFor further information on securing WordPress plugins, I recommend consulting the following official resources:\n*   [WordPress Plugin Handbook: Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F)\n*   [Common APIs: Nonces](https:\u002F\u002Fdeveloper.wordpress.org\u002Fapis\u002Fsecurity\u002Fnonces\u002F)\n*   [OWASP Guide to Broken Access Control](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F2017\u002FA5_2017-Broken_Access_Control)","The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to unauthorized data modification due to a lack of capability checks and nonce validation on sensitive AJAX actions. Unauthenticated attackers can exploit this to publish draft posts (exposing private content) or unpublish live content (causing service disruption) by targeting the 'publishTasks' and 'unpublishTasks' actions with arbitrary task IDs.","\u002F\u002F classes\u002Fcontroller.php @ 1.4.21\n\n\tpublic function exec( $task = '' ) {\n\t\tif (method_exists($this, $task)) {\n\t\t\t$this->_task = $task;   \u002F\u002FFor multicontrollers module version - who know, maybe that's will be?))\n\t\t\treturn $this->$task();\n\t\t}\n\t\treturn null;\n\t}\n\n    \u002F\u002F ...\n\n\tpublic function getPermissions() {\n\t\treturn array();\n\t}\n\n\tpublic function getNotNoncedMethods() {\n\t\treturn array();\n\t}\n\n\tpublic function getFrontMethods() {\n\t\treturn array();\n\t}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fai-copilot-content-generator\u002F1.4.21\u002Fclasses\u002Fcontroller.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fai-copilot-content-generator\u002F1.5.4\u002Fclasses\u002Fcontroller.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fai-copilot-content-generator\u002F1.4.21\u002Fclasses\u002Fcontroller.php\t2026-05-25 14:27:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fai-copilot-content-generator\u002F1.5.4\u002Fclasses\u002Fcontroller.php\t2026-06-22 20:55:48.000000000 +0000\n@@ -110,25 +118,73 @@\n \t *\n \t * @return array\n \t *\u002F\n-\tpublic function getNotNoncedMethods() {\n-\t\treturn array();\n-\t}\n-\t\u002F**\n-\t * Methods that do not require user rights control\n-\t *\u002F\n-\tpublic function getFrontMethods() {\n-\t\treturn array();\n-\t}\n-\tpublic function getModule() {\n-\t\treturn WaicFrame::_()->getModule( $this->getCode() );\n-\t}\n+\tpublic function getNoncedMethods() {\n+\t\treturn array();\n+\t}\n+\tpublic function allowNoprivAjax( $action ) {\n+\t\treturn false;\n+\t}\n+\tprotected function _getAdminAjaxCap() {\n+\t\t$cap = 'manage_options';\n+\t\t$adminMenu = WaicFrame::_()->getModule('adminmenu');\n+\t\tif ($adminMenu && method_exists($adminMenu, 'getMainCap')) {\n+\t\t\t$mainCap = $adminMenu->getMainCap();\n+\t\t\tif (!empty($mainCap)) {\n+\t\t\t\t$cap = $mainCap;\n+\t\t\t}\n+\t\t}\n+\t\treturn $cap;\n+\t}\n+\tprotected function _ajaxSecurityError( $message ) {\n+\t\tif (function_exists('status_header')) {\n+\t\t\tstatus_header(403);\n+\t\t}\n+\t\t$res = new WaicResponse();\n+\t\t$res->pushError($message);\n+\t\treturn $res->ajaxExec(true);\n+\t}\n+\tprotected function _checkAdminAjaxSecurity() {\n+\t\tif (false === check_ajax_referer('waic-nonce', 'waicNonce', false)) {\n+\t\t\treturn $this->_ajaxSecurityError(esc_html__('Security check failed', 'ai-copilot-content-generator'));\n+\t\t}\n+\t\tif (!current_user_can($this->_getAdminAjaxCap())) {\n+\t\t\treturn $this->_ajaxSecurityError(esc_html__('You have no permissions to view this page', 'ai-copilot-content-generator'));\n+\t\t}\n+\t\treturn true;\n+\t}\n+\tpublic function getModule() {\n+\t\treturn WaicFrame::_()->getModule( $this->getCode() );\n+\t}","The exploit involves sending a crafted POST or GET request to the WordPress AJAX endpoint (\u002Fwp-admin\u002Fadmin-ajax.php). An unauthenticated attacker sets the 'action' parameter to either 'publishTasks' or 'unpublishTasks' (depending on the module, these actions may be prefixed or routed through the plugin's dispatcher using a 'pl' parameter). By providing a target 'id' or 'task_id' in the request, the attacker triggers the corresponding status change logic in the plugin's controller. Because the vulnerable versions lack both 'current_user_can' checks and nonce verification for these actions, the plugin processes the request regardless of the requester's authentication status, allowing the attacker to manipulate the visibility of site content.","gemini-3-flash-preview","2026-07-15 08:55:16","2026-07-15 08:56:01",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.4.21","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fai-copilot-content-generator\u002Ftags\u002F1.4.21","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fai-copilot-content-generator.1.4.21.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fai-copilot-content-generator\u002Ftags\u002F1.5.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fai-copilot-content-generator.1.5.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fai-copilot-content-generator\u002Ftags"]